← Back to home

This document is provided in English only. The English version is the governing text.

Data Processing Addendum

Effective: 1 August 2026

THIS DATA PROCESSING ADDENDUM (“DPA”) is entered into as of the effective date of the Agreement by and between: (1) Crios Pte. Ltd. (“Crios”); and (2) the other person who is a counterparty to the Agreement (as defined below) into which this DPA is incorporated and forms a part (“Customer”), together the “Parties” and each a “Party”. Unless otherwise defined in this DPA, all capitalized terms have the meaning given to them in the Agreement.

1. Interpretation

In this DPA the following terms have the meanings set out below:

  • “Addendum Effective Date” means the effective date of the Agreement.
  • “Agreement” means the Crios Master Services Agreement under which Crios has agreed to provide services to Customer.
  • “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and any binding regulations promulgated thereunder.
  • “Controller” means the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including, as applicable, any “business” as defined by the CCPA.
  • “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates, and “Data Subject Request” means the exercise by a Data Subject of its rights under Data Protection Laws in respect of Customer Personal Data.
  • “EEA” means the European Economic Area.
  • “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020, including its implementing ordinances.
  • “Personal Data Breach” means an actual breach of Crios’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in Crios’s possession, custody, or control. Personal Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, or denial-of-service attacks on firewalls or networked systems).
  • “Personnel” means a person’s employees, agents, consultants, or contractors.
  • “Processor” means the entity that Processes Personal Data on behalf of the Controller, including, as applicable, any “service provider” as defined by the CCPA.
  • “Restricted Transfer” means the disclosure, grant of access, or other transfer of Customer Personal Data to any person located in: (i) in the context of the EEA, any country or territory outside the EEA that does not benefit from an adequacy decision of the European Commission (an “EU Restricted Transfer”); and (ii) in the context of the UK, any country or territory outside the UK that does not benefit from an adequacy decision of the UK Government (a “UK Restricted Transfer”), in each case which would be prohibited without a legal basis under Chapter V of the GDPR.
  • “SCCs” means the standard contractual clauses approved by the European Commission pursuant to Implementing Decision (EU) 2021/914.
  • “Service Data” means data relating to the use, support, and/or operation of the Services that is collected directly by Crios from or about users of the Services for its own limited purposes described in Section 13 (certain of which may constitute Personal Data), and whose Processing purposes and means are determined by Crios.
  • “Services” means the services and activities carried out by Crios for Customer pursuant to the Agreement.
  • “Sensitive Data” includes without limitation: (i) government-issued identification numbers; (ii) protected health information and other health, medical, or insurance data; (iii) genetic, biometric, neural, or biological information; (iv) passwords and login credentials to online accounts; (v) credentials to financial accounts and payment card information subject to PCI DSS; (vi) tax return data; (vii) Personal Data of children; (viii) special categories of personal data as defined in the GDPR and data relating to criminal convictions and offenses; (ix) racial, ethnic, or national origin; religious or philosophical beliefs; sex life or sexual orientation; citizenship or immigration status; union membership; (x) precise location information; (xi) contents of communications to which Customer is not a party; and (xii) any bulk U.S. sensitive personal data or U.S. government-related data as defined in 28 C.F.R. Part 202, as amended.
  • “Supervisory Authority” means any entity with authority to enforce Data Protection Laws, including (i) in the context of the EEA and the EU GDPR, as defined therein, and (ii) in the context of the UK, the UK Information Commissioner’s Office.
  • “UK Transfer Addendum” means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of the Mandatory Clauses included in Part 2 thereof.

2. Scope of this Data Processing Addendum

This DPA applies generally to Crios’s Processing of Customer Personal Data under the Agreement. Annex 2 (European Annex) applies only if and to the extent such Processing is subject to the GDPR. Annex 5 (California Annex) applies only if and to the extent Crios’s Processing of personal information on behalf of Customer is subject to the CCPA with respect to which Customer is a “business”. To the extent Customer’s jurisdiction is not in the EEA, UK, or Switzerland, the SCCs as populated in Annex 2 shall be deemed amended to replace references to the European Union and its laws with Customer’s jurisdiction and its applicable Data Protection Laws.

For Crios Enterprise (self-hosted) deployments, Customer Personal Data processed within Customer’s own infrastructure is not Processed by Crios and is outside the scope of this DPA; this DPA applies only to Customer Personal Data that Crios actually Processes on Customer’s behalf (for example, in connection with support requests or diagnostic data Customer chooses to share).

3. Processing of Customer Personal Data

Crios shall not Process Customer Personal Data other than on Customer’s instructions, to provide the Services, or as required by applicable law. Customer instructs Crios to Process Customer Personal Data as necessary to provide the Services under and in accordance with the Agreement. The details of Crios’s Processing of Customer Personal Data (including the respective roles of the Parties) are described in Annex 1 (Data Processing Details). For the avoidance of doubt, Crios is entitled to process Service Data as a Controller as set forth in Section 13 (Service Data).

4. Crios Personnel

Crios shall take commercially reasonable steps designed to ascertain the reliability of any Crios Personnel who Process Customer Personal Data, and shall ensure that all such Personnel are subject to written confidentiality agreements or professional or statutory obligations of confidentiality.

5. Security

Crios shall implement and maintain the technical and organizational measures described in Annex 4 (Security Measures) (the “Security Measures”), which are designed to protect Customer Personal Data against a Personal Data Breach. Crios may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Customer Personal Data.

6. Sub-Processing

Customer generally authorizes Crios to appoint Sub-Processors in accordance with this Section 6. Crios may continue to use the Sub-Processors already engaged as at the date of this DPA, as shown, together with their functions and locations, in the Sub-Processor list referenced in Annex 3 (the “Sub-Processor List”).

Crios shall give Customer prior notice of the appointment of any proposed Sub-Processor, including reasonable details of the Processing to be undertaken, by updating the Sub-Processor List. If, within ten (10) days of the update, Customer notifies Crios in writing of objections on reasonable grounds: (a) Crios shall use reasonable efforts to make available a commercially reasonable change in the provision of the Services that avoids the proposed Sub-Processor; and (b) where such a change cannot be made within thirty (30) days, no commercially reasonable change is available, or Customer declines to bear the cost of the change, either Party may terminate the Agreement — in whole or to the extent it relates to the Services requiring the proposed Sub-Processor — by written notice with immediate effect, as Customer’s sole and exclusive remedy. If Customer does not object within the objection period, Customer is deemed to have approved the engagement.

With respect to each Sub-Processor, Crios shall maintain a written contract that includes terms offering at least a level of protection for Customer Personal Data substantially similar to those of this DPA (including the Security Measures). Crios remains liable for any breach of this DPA caused by a Sub-Processor to the same extent as if Crios had performed the Processing itself.

7. Data Subject Rights

Taking into account the nature of the Processing, Crios shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligations to respond to Data Subject Requests, to the extent required by Data Protection Laws. If Crios receives a Data Subject Request, Customer is responsible for responding to it. If required by Data Protection Laws, Crios shall: (a) promptly notify Customer of the request; and (b) not respond to the request other than to advise the Data Subject to submit it to Customer, except on Customer’s written instructions or as required by law. Except to the extent prohibited by applicable law, Customer shall reimburse Crios’s reasonable costs (at then-current professional services rates) for cooperation and assistance provided under this Section 7 beyond the self-service features included in the Services.

8. Personal Data Breach

Crios shall notify Customer without undue delay upon determining that a Personal Data Breach has occurred affecting Customer Personal Data, and shall provide Customer with information (to the extent within Crios’s possession and knowledge and not compromising the security of other data) to provide reasonable assistance to Customer in meeting its breach-reporting obligations under Data Protection Laws. Crios’s notification of or response to a Personal Data Breach is not an acknowledgement of fault or liability. Crios shall reasonably cooperate with Customer and take commercially reasonable steps to assist in the investigation of the breach. Customer is solely responsible for complying with notification laws applicable to Customer and fulfilling third-party notification obligations. If a notification by Customer directly or indirectly references or identifies Crios, where permitted by applicable law, Customer agrees to notify Crios in advance and, in good faith, consider any clarifications or corrections Crios reasonably recommends that relate to Crios’s involvement and are consistent with applicable law.

9. Return and Deletion

Upon the date of cessation of any Services involving the Processing of Customer Personal Data (the “Cessation Date”), Crios shall promptly cease all Processing of Customer Personal Data for any purpose other than storage or as otherwise permitted or required under this DPA. On written request made no later than thirty (30) days after the Cessation Date (the “Post-Cessation Period”), and to the extent technically possible in the circumstances, Crios shall within thirty (30) days of the request: (a) return a complete copy of all Customer Personal Data in its possession by secure file transfer and thereafter delete all other copies; or (b) delete all Customer Personal Data in its possession. If Customer gives no instruction during the Post-Cessation Period, Crios shall promptly thereafter delete all Customer Personal Data then in its possession to the fullest extent technically possible. Crios may retain Customer Personal Data where required by applicable law, for the period required, provided it maintains the confidentiality of the data and Processes it only as necessary for the purposes specified by that law. Crios may continue to process information derived from Customer Personal Data that has been aggregated and de-identified such that it is no longer Personal Data, subject to the limitations in Section 6.2 of the Agreement.

10. Audit Rights

Upon Customer’s request, no more than once per year, Crios shall make available to Customer or its appointed third-party auditor information regarding Crios’s compliance with this DPA and Data Protection Laws. If Customer, acting reasonably, provides documentary evidence that the information made available is not sufficient to demonstrate compliance, Crios shall allow for and contribute to audits, including inspections, by Customer or its mandated auditor in relation to the Processing of Customer Personal Data.

Before any audit, Customer must submit a detailed proposed audit plan (scope, duration, start date) providing for confidential treatment of all information exchanged, and the Parties shall mutually agree on a final plan. Customer shall ensure its auditors use best efforts to avoid disruption to Crios’s equipment, personnel, data, and business, including the confidentiality and availability of other customers’ data and services. Customer bears all costs of the audit. If the controls or measures to be assessed are covered by a SOC 2 Type 2, ISO, NIST, or similar report performed by a qualified third-party auditor within twelve (12) months of the request, and Crios confirms in writing that there have been no known material changes to the audited controls, Customer agrees to accept that report in lieu of an audit of those controls. Such reports are Crios’s Confidential Information.

Crios may deny an audit request: (i) without thirty (30) days’ prior written notice; (ii) from an auditor Crios has not approved (approval not to be unreasonably withheld); (iii) from any individual who does not present reasonable evidence of identity and authority; (iv) if the auditor declines to enter into a non-disclosure agreement; (v) where, and to the extent, Crios reasonably considers the audit would materially interfere with confidentiality, data security, or business operations; (vi) more than once in any twelve-month period, except following a Personal Data Breach or where conducted by a Supervisory Authority; or (vii) where a report has been accepted in lieu under this Section. Nothing in this DPA requires Crios to furnish more information about its Sub-Processors than they make generally available to their customers, or to breach any duty of confidentiality.

11. Customer’s Responsibilities

Without limiting Crios’s obligations under Section 5, Customer is solely responsible for its use of the Services, including: (a) making appropriate use of the Services to maintain a level of security appropriate to the risk in respect of Customer Personal Data; (b) securing the account credentials, systems, and devices Customer uses to access the Services; (c) securing Customer’s systems and infrastructure that interact with the Services; and (d) backing up Customer Personal Data.

Customer shall ensure that:

  • there is, and will be throughout the term of the Agreement, a valid legal basis for Crios’s Processing of Customer Personal Data in accordance with this DPA and the Agreement (including all instructions issued by Customer), for the purposes of all Data Protection Laws (including Articles 6, 9(2), and/or 10 of the GDPR, where applicable); and
  • all Data Subjects have been presented with all required notices and statements (including as required by Articles 12–14 of the GDPR, where applicable) and have provided all required consents relating to the Processing of Customer Personal Data by Crios.

Customer agrees that the Services, the Security Measures, and Crios’s commitments under this DPA are adequate to meet Customer’s needs, including any security obligations of Customer under Data Protection Laws, and provide a level of security appropriate to the risk. Customer shall not provide or otherwise make available any Sensitive Data to Crios, and Customer is liable for any Sensitive Data it does submit. Except to the extent prohibited by Data Protection Laws, Customer shall reimburse Crios’s reasonable costs (at then-current professional services rates) for cooperation, information, or assistance requested by Customer under this DPA (including under Sections 7, 8, and 10 and Annex 2), beyond self-service features included in the Services; provided that Crios bears its own costs where an audit under Section 10 reveals material non-compliance by Crios with this DPA or Data Protection Laws.

12. Liability

THE TOTAL AGGREGATE LIABILITY OF EITHER PARTY TOWARDS THE OTHER PARTY, HOWSOEVER ARISING, UNDER OR IN CONNECTION WITH THE AGREEMENT, THIS DPA, AND THE SCCS (IF AND AS THEY APPLY) WILL UNDER NO CIRCUMSTANCES EXCEED ANY LIMITATIONS OR CAPS ON, AND SHALL BE SUBJECT TO ANY EXCLUSIONS OF, LIABILITY AND LOSS AGREED BY THE PARTIES IN THE AGREEMENT; PROVIDED THAT NOTHING IN THIS SECTION 12 AFFECTS ANY PERSON’S LIABILITY TO DATA SUBJECTS UNDER THE THIRD-PARTY BENEFICIARY PROVISIONS OF THE SCCS (IF AND AS THEY APPLY).

13. Service Data

Customer acknowledges that Crios may, as a Controller, collect, use, and disclose Service Data for the following limited business purposes:

  • accounting, tax, billing, audit, and compliance purposes;
  • to test, operate, provide, secure, improve, and maintain the Services, using aggregated and de-identified data in accordance with Section 6.2 of the Agreement — for the avoidance of doubt, Crios does not use Customer Data content to train or fine-tune generally available machine-learning models without Customer’s express prior written consent;
  • to investigate fraud, abuse, security incidents, or unlawful use of the Services; and
  • as otherwise permitted or required by applicable law.

In respect of such Processing, Crios: (a) independently determines the purposes and means; (b) shall comply with applicable Data Protection Laws; (c) shall Process Service Data as described in its applicable privacy notices, as updated from time to time; and (d) where possible, shall apply technical and organizational safeguards to any relevant Personal Data no less protective than the Security Measures. Customer acknowledges that the Processing of Service Data for the purposes in this Section 13 is compatible with the Processing to provide the Services.

14. Change in Laws

Crios may on notice vary this DPA to the extent it reasonably considers necessary to address the requirements of Data Protection Laws from time to time, including by varying or replacing the SCCs in the manner described in Annex 2.

15. Incorporation and Precedence

This DPA is incorporated into and forms part of the Agreement with effect from the Addendum Effective Date. In the event of any conflict or inconsistency between: (a) this DPA and the Agreement, this DPA prevails; and (b) any SCCs entered into pursuant to Annex 2 and this DPA and/or the Agreement, the SCCs prevail in respect of the Restricted Transfer to which they apply.

Annex 1 — Data Processing Details

Crios / “data importer” details

Name: Crios Pte. Ltd.
Address: 20 Cecil Street, #05-03 Plus, Singapore 049705
Contact for data protection: support@crios.ai
Activities: provision of the Services under the Agreement.
Role: Processor.

Customer / “data exporter” details

Activities: use and receipt of the Services as part of Customer’s ongoing business operations.
Role: Controller — in respect of Processing of Customer Personal Data for which Customer is a Controller in its own right; and Processor — in respect of Processing for which Customer itself acts as a Processor on behalf of another person (including its affiliates, where applicable).

Categories of Data Subjects

Customer’s Staff — employees and non-employee workers; contractors, consultants, and agents; directors and officers; and other persons who work or provide services for Customer (including persons joining an organization set up or administered by Customer’s designees) — and any other natural person whose Personal Data is processed by Customer when using the Services. Each category includes current, past, and prospective Data Subjects.

Categories of Personal Data

  • Personal details — names and personal characteristics.
  • Contact details — business or home address, email address, telephone details, and social media identifiers.
  • Authentication details — usernames, access tokens, and other access protocols (excluding Sensitive Data, which must not be submitted).
  • Communications data based on exchanges with Crios through the Services.
  • Transactional data relating to subscriptions and purchases, including subscription type and transaction history.
  • Inputs, prompts, and user-generated content — briefs, prompts, instructions, source code, repositories, files, documents, knowledge-base entries, and other content submitted to or generated through the Services, together with sandbox execution data (commands and their outputs, generated code, session logs) and associated metadata.
  • Technological details — IP addresses, unique identifiers, device and browser information, and activity data relating to use of the Services.

Sensitive Data: none — Customer agrees that Sensitive Data (including “sensitive data” as referenced in Clause 8.7 of the SCCs) must not be submitted to the Services, and Customer is liable for any Sensitive Data it does submit.

Frequency of transfer: ongoing, as initiated by Customer through its use of the Services.
Nature of the Processing: Processing operations required to provide the Services in accordance with the Agreement, including hosting, executing sandboxed agent sessions, transmitting Inputs to the Model Providers used to fulfill Customer’s requests, and storing session records.
Purpose of the Processing: as necessary to provide the Services as initiated by Customer; to comply with Customer’s other reasonable instructions consistent with this DPA; and to secure and maintain the Services.
Duration of Processing / retention: for the period determined in accordance with the Agreement and this DPA, including Section 9.
Transfers to Sub-Processors: as, and for the purposes, described in the Sub-Processor List.

Annex 2 — European Annex

1. Processing of Customer Personal Data

Where Crios receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Crios shall inform Customer. Customer acknowledges and agrees that all instructions issued by Customer with respect to the Processing of Customer Personal Data shall comply with the GDPR and all other applicable laws.

2. Data Protection Impact Assessment and Prior Consultation

Taking into account the nature of the Processing and the information available to it, Crios shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments and prior consultations with Supervisory Authorities that Customer reasonably considers to be required by Articles 35 or 36 of the GDPR, in each case solely in relation to the Processing of Customer Personal Data by Crios.

3. Restricted Transfers

EU Restricted Transfers. To the extent any Processing of Customer Personal Data under this DPA involves an EU Restricted Transfer from Customer to Crios, the Parties shall comply with their respective obligations under the SCCs, which are deemed populated as set out below and entered into by the Parties and incorporated by reference into this DPA:

  • Module Two applies where Customer is a Controller in its own right; Module Three applies where Customer acts as a Processor on behalf of another person.
  • The optional Docking Clause in Clause 7 is not used. In Clause 9, Option 2 (general written authorization) applies, with the advance-notice period set out in Section 6 of this DPA. In Clause 11, the optional language is not used. In Clause 13, all square brackets are removed and the text retained.
  • In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; for Clause 18, disputes arising from the SCCs shall be resolved by the courts of Ireland.
  • Annex I to the Appendix to the SCCs is populated with the information in Annex 1 of this DPA, with Customer as data exporter and Crios as data importer. The competent Supervisory Authority is determined by the establishment or representative of Customer in the EU, or, absent either, the Member State where relevant Data Subjects are located.
  • Annex II to the Appendix to the SCCs is populated with the Security Measures in Annex 4 of this DPA.

UK Restricted Transfers. To the extent any Processing involves a UK Restricted Transfer, the SCCs apply as varied by the UK Transfer Addendum: Tables 1–3 are deemed populated with the corresponding details in Annex 1 and this Annex 2; Table 4 is completed with the “Data Importer” box ticked; and the Parties agree to be bound by the Mandatory Clauses of the UK Transfer Addendum.

Swiss Restricted Transfers. Where the FADP applies, the SCCs apply as adjusted so that: references to the GDPR are understood as references to the FADP insofar as transfers are subject to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent Supervisory Authority for transfers exclusively subject to the FADP; and Data Subjects in Switzerland may exercise their rights in their place of habitual residence.

New transfer mechanisms. Crios may on notice vary this DPA to replace the relevant SCCs with any new or replacement form of standard contractual clauses or another lawful transfer mechanism under Chapter V of the GDPR. On specific written request of a Supervisory Authority, Data Subject, or further Controller, Crios shall provide Customer with an executed version of the relevant SCCs for countersignature and onward provision.

Supplementary measures. To the extent permitted by applicable law: each Party shall promptly notify the other in writing of any subpoena or other judicial or administrative order by a public authority seeking access to or disclosure of Personal Data, including details of the data and authority concerned; Customer may defend such legal challenge in lieu of or on behalf of Crios, and Crios shall reasonably cooperate; neither Party shall disclose the requested Personal Data until all reasonable challenges have been exhausted, and shall provide the minimum information permissible when responding; where notification is legally prohibited, the notified Party shall use its best efforts to obtain a waiver and shall document those efforts; and each Party shall promptly notify the other of any direct access by public authorities to Personal Data of which it becomes aware, unless prohibited by law. Crios represents and warrants that: (i) it has not purposefully created backdoors or similar programming that could be used to access its systems or Personal Data; (ii) it has not purposefully created or changed its business processes to facilitate access to its systems or Personal Data by public authorities and shall not voluntarily cooperate with public authorities in relation to the same; and (iii) no applicable law or government policy to which Crios is subject requires it to create or maintain backdoors, to facilitate access to Personal Data or systems, or to possess corresponding encryption keys.

Annex 3 — Sub-Processors

For the current list of Sub-Processors, including their functions and locations, please refer to the Sub-Processor List published at https://crios.ai/subprocessors (or such successor location as Crios may notify) or made available on request at support@crios.ai, as updated from time to time in accordance with Section 6 of this DPA.

Annex 4 — Security Measures

As from the Addendum Effective Date, Crios will implement and maintain the following Security Measures:

  • Workload isolation. Agent sessions execute in ephemeral, logically isolated sandbox environments with managed lifecycles, resource budgets, and hardware-virtualized isolation boundaries (microVM-class isolation) between workloads.
  • Network controls. Restrictive egress network policies for sandboxed workloads, non-root execution, read-only root filesystems, and dropped kernel capabilities.
  • Secrets management. Provider keys and integration credentials are stored in a dedicated secrets-management system, injected per session, and excluded from logs.
  • Data security controls, including segregation of customer data, role-based access control with least privilege, per-project isolation of memory and knowledge stores, and encryption of Customer Personal Data in transit and at rest using commercially available encryption.
  • Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, with password and multi-factor authentication controls.
  • Audit logging. System and event logging of administrative and agent actions, with export capabilities for customer compliance workflows.
  • Physical and environmental security of the data centers and hosting facilities used to operate the Services, as provided by Crios’s infrastructure Sub-Processors.
  • Operational procedures and change management, including configuration management, monitoring, secure disposal of systems and media, and tracked, tested, and approved changes to technology assets.
  • Incident management procedures enabling Crios to investigate, respond to, mitigate, and notify of security events.
  • Business continuity and disaster recovery procedures designed to maintain service and recover from foreseeable emergencies or disasters.

Crios may update or modify these Security Measures from time to time, provided that such updates do not decrease the overall security of Customer Personal Data.

Annex 5 — California Annex

In this Annex, the terms “business purpose”, “commercial purpose”, “personal information”, “sell”, “service provider”, and “share” have the meanings given in the CCPA.

The business purposes and services for which Crios Processes personal information are to provide the Services to and on behalf of Customer as set forth in the Agreement. It is the Parties’ intent that, with respect to any personal information, Crios is a service provider. Crios: (a) acknowledges that personal information is disclosed by Customer only for the limited and specific purposes described in the Agreement; (b) shall comply with its applicable obligations under the CCPA and provide the same level of privacy protection as required of businesses by the CCPA; (c) agrees that Customer may take reasonable and appropriate steps under Section 10 (Audit Rights) to help ensure Crios’s use of personal information is consistent with Customer’s obligations under the CCPA; (d) shall notify Customer in writing if it determines it can no longer meet its obligations under the CCPA; and (e) agrees that Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Crios shall not: (a) sell or share any personal information; (b) retain, use, or disclose any personal information for any purpose other than the business purposes specified in the Agreement, including any commercial purpose, except as otherwise permitted by the CCPA; (c) retain, use, or disclose personal information outside of the direct business relationship between Crios and Customer; or (d) except as otherwise permitted by the CCPA, combine personal information received pursuant to the Agreement with personal information received from or on behalf of another person or collected from Crios’s own interaction with any consumer to whom the personal information pertains.

Contact

Questions about this DPA or Crios’s data protection practices: support@crios.ai.