Data Processing Agreement

If you need a signed DPA, please email sales@hercules.app.

This Data Processing Agreement (including all Schedules attached hereto, the “DPA”) is entered into between Zeus AI Labs, Inc., the operator of the Hercules platform (“Hercules”), and the Enterprise Plan customer identified in the signature block below or in the applicable order form entered into with Hercules (“Customer”).

This DPA is incorporated into, and is subject to the terms and conditions of, the enterprise agreement, order form or other signed agreement between Hercules and Customer governing Customer’s use of the Service, together with the Hercules Terms of Service available at https://hercules.app/legal/terms (the “Terms”) to the extent applicable (collectively, the “Agreement”). This DPA is available exclusively to Customers subscribed to an Enterprise Plan and applies only when it has been executed by both parties or expressly incorporated into Customer’s signed Agreement.

This DPA applies to the extent Hercules’ Processing of Customer Personal Data is subject to the Data Protection Laws. This DPA is effective for the term of the Agreement and for so long thereafter as Hercules Processes Customer Personal Data.

1. Definitions#

1.1. “Controller” means the entity which determines the purposes and means of the Processing of Personal Data. The term “Controller” includes a “business” as defined under the CCPA.#

1.2. “Customer Personal Data” means the Personal Data described under Schedule 1 to this DPA.#

1.3. “Data Protection Laws” means all applicable laws and regulations, including laws and regulations of: (i) the European Union, the European Economic Area and their member states, Switzerland and the United Kingdom; (ii) the United States (including, but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the “CCPA”) and other applicable state privacy laws); and (iii) any other jurisdiction in which the parties operate, in each case, applicable to the Processing of Personal Data under the Agreement and this DPA.#

1.4. “Data Subjects” means the individuals identified in Schedule 1 to this DPA.#

1.5. “Enterprise Plan” means the Hercules enterprise subscription plan described in the Terms, on the Hercules pricing page or in the applicable order form, and “Plan” means any subscription plan for the Service offered by Hercules.#

1.6. “EU SCCs” means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, supplemented, updated or replaced from time to time.#

1.8. “Personal Data” and “Processing” will each have the meaning given to them in the Data Protection Laws. The term “Personal Data” includes “personal information,” “personally identifiable information,” and equivalent terms as such terms may be defined by the Data Protection Laws.#

1.9. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.#

1.10. “Privacy Policy” means the Hercules privacy policy available at https://hercules.app/legal/privacy, as updated from time to time.#

1.11. “Processor” means the entity which Processes Personal Data on behalf of the Controller. The term “Processor” includes a “service provider” as that term is defined under the CCPA.#

1.12. “Sell” has the meaning given in the Data Protection Laws.#

1.15. “Sub-Processor” means another Processor engaged by a Processor to carry out Processing on behalf of a Controller.#

1.16. “UK Addendum” means the International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner for parties making restricted transfers, which entered into force on 21 March 2022 (collectively, with the EU SCCs, the “SCCs”).#

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

2. Processing of Customer Personal Data#

2.1. Customer is a Controller of Customer Personal Data (or a Processor authorized by the applicable Controller) and Hercules is a Processor of Customer Personal Data. If Customer is itself acting as a Processor for Customer Personal Data on behalf of a Controller of such data, Hercules will Process such data as a Sub-Processor to Customer. The use of an Organization workspace, or the participation of Members or End Users in the Service, does not change the parties’ respective roles under this DPA. The details of Hercules’ Processing of Customer Personal Data are described in Schedule 1 to this DPA.#

2.3. Customer authorizes Hercules to Process Customer Personal Data for the purposes set forth in the Agreement, including service provision, model and feature improvement, internal evaluations, and creation of deidentified information, only as permitted by Section 2.2 and Data Protection Laws. Privacy Mode applies prospectively as described in the Privacy Policy, including to deidentified content and evaluations. These permissions do not override Section 9 or the Google API data restrictions in the Terms and Privacy Policy.#

2.4. Hercules will promptly inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Laws. If applicable laws preclude Hercules from complying with Customer’s instructions, Hercules will inform Customer of its inability to comply with the instructions, to the extent permitted by law.#

2.5. Each of Customer and Hercules will comply with their respective obligations under the Data Protection Laws. Hercules shall notify Customer if it determines that it cannot meet its obligations under the Data Protection Laws. Customer has the right to take reasonable steps to ensure that Hercules uses Customer Personal Data in a manner consistent with Customer’s obligations under Data Protection Laws by exercising Customer’s audit rights in Section 10 of this DPA.#

3. Cross-Border Transfers of Personal Data#

3.1. With respect to Customer Personal Data originating from the European Economic Area (“EEA”), the United Kingdom (the “UK”) or Switzerland that is transferred from Customer to Hercules, the parties agree to comply with the general clauses and with “Module Two” (Controller to Processor) and “Module Three” (Processor to Processor) of the EU SCCs, as applicable, which are incorporated herein by reference, with Customer as the “data exporter” and Hercules as the “data importer.”#

3.2. For purposes of the EU SCCs the parties agree that:#

3.2.1. The optional docking clause 7 of the EU SCCs will not apply.

3.2.2. In clause 9 of the EU SCCs, option 2 will apply and the time period for prior notice of Sub-Processor changes will be as set forth in Section 5.2 of this DPA.

3.2.3. The optional language in clause 11 of the EU SCCs will not apply.

3.2.4. In clause 17 of the EU SCCs, option 1 applies and the EU SCCs shall be governed by the laws of Ireland.

3.2.5. In clause 18(b) of the EU SCCs, the parties agree to submit to the jurisdiction of the courts of Ireland.

3.2.6. In Annex I, Section A (List of Parties) of the EU SCCs, (i) the Customer is the data exporter and Hercules is the data importer and their identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in this DPA or as otherwise communicated by each party to the other party; (ii) Customer is a Controller (under “Module Two” of the EU SCCs) or Processor (under “Module Three” of the EU SCCs), and Hercules is a Processor; (iii) the activities relevant to the data transferred under the EU SCCs relate to the provision of the Service pursuant to the Agreement; and (iv) entering into this DPA shall be treated as each party’s signature of Annex I, Section A, as of the effective date of this DPA.

3.2.7. In Annex I, Section B (Description of Transfer) of the EU SCCs: (i) Schedule 1 to this DPA describes Hercules’ Processing of Customer Personal Data; (ii) the frequency of the transfer is continuous (for as long as Customer uses the Service); (iii) Customer Personal Data will be retained in accordance with Clause 8.5 of the EU SCCs and this DPA; (iv) Hercules uses the Sub-Processors described in Section 5.2 of this DPA to support the provision of the Service.

3.2.8. In Annex I, Section C (Competent Supervisory Authority) of the EU SCCs, the competent supervisory authority identified in accordance with Clause 13 of the EU SCCs is the competent supervisory authority communicated by Customer to Hercules.

3.2.9. In Annex II of the EU SCCs, the data importer has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Customer Personal Data as described in Hercules’ Trust Center available at https://trust.hercules.app, provided that no such update materially reduces the overall security of the Service.

3.4. With respect to transfers from Customer to Hercules of Customer Personal Data originating from the UK, the parties agree that the UK Addendum will complement the EU SCCs to the extent required under Data Protection Laws. The UK Addendum is incorporated herein by reference. The parties agree that the UK Addendum is completed as follows:#

3.4.1. For the purposes of Part 1 of the UK Addendum:

3.4.2. Table 1 (Parties): the start date is the effective date of this DPA, the exporter is the Customer and the importer is Hercules, the table is deemed to be completed with the information set out in Section 3.2 of this DPA, and by signing this DPA, parties are deemed to have signed the UK Addendum.

3.4.3. Table 2 (Selected SCCs, Modules and Selected Clauses): the “Approved EU SCCs” which the UK Addendum is appended to are the EU SCCs incorporated into this DPA and completed as set out in Section 3.2 of this DPA.

3.4.4. Table 3 (Appendix Information): the information requested in Annex 1 is provided in Sections 3.2.6 and 3.2.7 of this DPA; the security measures requested in Annex 2 are described in Hercules’ Trust Center available at https://trust.hercules.app; the list of Sub-Processors is available as described in Section 5.2 of this DPA.

3.4.5. Table 4: both the data importer and the data exporter may end the UK Addendum as set out in section 19 of the UK Addendum.

3.4.6. The competent supervisory authority for data transfers in connection with the UK Addendum will be the Information Commissioner’s Office.

4. Confidentiality and Security#

4.1. Hercules will require Hercules’ personnel who access Customer Personal Data to commit to protect the confidentiality of Customer Personal Data.#

4.2. Hercules will implement commercially reasonable technical and organizational measures, as further described in Hercules’ Trust Center available at https://trust.hercules.app (which Hercules may update from time to time provided that no such update materially reduces the overall security of the Service), that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.#

4.3. To the extent required by Data Protection Laws, Hercules will provide Customer with reasonable assistance as necessary for the fulfillment of Customer’s obligations under Data Protection Laws to maintain the security of Customer Personal Data.#

5. Sub-Processing#

5.1. Customer hereby authorizes Hercules to appoint (and permit each Sub-Processor appointed in accordance with this Section 5 to appoint) Sub-Processors in accordance with this Section 5.#

5.2. The Sub-Processors appointed by Hercules as of the date of this DPA are set out in the current sub-processor list maintained by Hercules at https://trust.hercules.app/subprocessors (the “Sub-Processors List”), each of which Customer hereby generally authorizes. Hercules will inform Customer of any intended changes concerning the addition or replacement of any appointed Sub-Processors (a “New Sub-Processor”) at least ten (10) days before the New Sub-Processor begins Processing Customer Personal Data, along with reasonably detailed information about such New Sub-Processor, by email notification or through the notification mechanism made available on the Sub-Processors List page (to which Customer is responsible for subscribing).#

5.4. Hercules will enter into an agreement with each Sub-Processor that imposes on the Sub-Processor, in substance, the same obligations that apply to Hercules under this DPA. Where any of its Sub-Processors fails to fulfill its data protection obligations, Hercules will be liable to Customer for the performance of its Sub-Processors’ obligations.#

6. Data Subject Rights#

Customer is responsible for responding to any Data Subject requests relating to Customer Personal Data (“Requests”). If Hercules receives any Requests during the term of the Agreement, Hercules will advise the Data Subject to submit the request directly to Customer. Hercules will provide Customer with reasonable assistance to permit Customer to respond to Requests.

7. Personal Data Breaches#

Upon becoming aware of a Personal Data Breach affecting Customer Personal Data, Hercules will (i) promptly take measures designed to remediate the Personal Data Breach, (ii) notify Customer without undue delay, and (iii) provide Customer with the information then available to Hercules concerning the Personal Data Breach and reasonable subsequent updates, in each case to the extent needed for Customer’s response. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer. Customer may request that Hercules reasonably assist Customer’s efforts to notify the competent data protection authorities and/or affected Data Subjects of a Personal Data Breach, if Customer is required to do so under the Data Protection Laws. Hercules’ notice of or response to a Personal Data Breach under this Section 7 will not be an acknowledgement or admission by Hercules of any fault or liability with respect to the Personal Data Breach.

8. Data Protection Impact Assessment; Prior Consultation#

Customer may request reasonable assistance from Hercules in connection with conducting data protection impact assessments and consultation with data protection authorities if Customer is required to engage in such activities under applicable Data Protection Laws and the data protection impact assessment or consultation relates to the Processing by Hercules of Customer Personal Data.

9. Deletion of Customer Personal Data#

At Customer’s election, made by written request to Hercules before the termination or expiration of the Agreement (or within any data export period set out in the Agreement), Hercules will return Customer Personal Data to Customer by making it available for export through the Service in a commonly used electronic format. Whether or not Customer makes such an election, Customer instructs Hercules to delete Customer Personal Data within ninety (90) days after the termination or expiration of the Agreement and delete existing copies unless applicable law requires otherwise. The parties agree that the certification of deletion described in the SCCs, if applicable, shall be provided only upon Customer’s written request. Notwithstanding the foregoing, Hercules may retain Customer Personal Data to the extent and for the period required by applicable laws provided that Hercules maintains the confidentiality of all such Customer Personal Data and Processes such Customer Personal Data only as necessary for the purpose(s) specified in the applicable laws requiring its storage.

10. Audits#

10.1. Customer may audit Hercules’ compliance with its obligations under this DPA up to once per year. In addition, Customer may perform more frequent audits (including inspections) in the event: (1) Hercules suffers a Personal Data Breach affecting Customer Personal Data; (2) Customer has genuine, documented concerns regarding Hercules’ compliance with this DPA or the Data Protection Laws; or (3) where required by the Data Protection Laws, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data. Hercules will contribute to such audits by providing Customer or Customer’s regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit.#

10.2. To request an audit, Customer must submit a detailed proposed audit plan to privacy@hercules.app at least one month in advance of the proposed audit start date. The proposed audit plan must describe the proposed scope, duration, start date of the audit, and the identity of any third party Customer intends to appoint to perform the audit. Hercules will review the proposed audit plan and provide Customer with any concerns or questions (for example, Hercules may object to the third party auditor as described in Section 10.3, provide an Audit Report as described in Section 10.4, or identify any requests for information that could compromise Hercules confidentiality obligations or security, privacy, employment or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least two weeks in advance of the proposed audit start date. Nothing in this Section 10 shall require Hercules to breach any duties of confidentiality.#

10.3. Hercules may object to third party auditors that are, in Hercules’ reasonable opinion, not suitably qualified or independent, a competitor of Hercules, or otherwise manifestly unsuitable. Customer will appoint another auditor or conduct the audit itself if the parties cannot resolve Hercules’ auditor objection after negotiating in good faith.#

10.4. If the requested audit scope is addressed in a SOC 2 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor on Hercules’ systems that Process Customer Personal Data (“Audit Reports”) within twelve (12) months of Customer’s audit request and Hercules confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by the Audit Report.#

10.5. The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and Hercules’ health and safety or other relevant policies. The audit may not unreasonably interfere with Hercules’ business activities.#

10.6. Any audits are at Customer’s expense and Customer will promptly disclose to Hercules any perceived non-compliance or security concerns discovered during the audit, together with all relevant details.#

10.7. The parties agree that the audits described in the SCCs, if applicable, shall be performed in accordance with this Section 10.#

11. Liability#

11.1. Each party’s liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement.#

11.2. Customer acknowledges that Hercules is reliant on Customer for direction as to the extent to which Hercules is entitled to Process Customer Personal Data on behalf of Customer in performance of the Service. Consequently, Hercules will not be liable under the Agreement or this DPA for any claim brought by a Data Subject arising from (a) any action or omission by Hercules in compliance with Customer’s instructions or (b) Customer’s failure to comply with its obligations under the Data Protection Laws.#

12. General Provisions#

With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement (including any general permission in the Terms concerning the Processing of Customer Personal Data), the provisions of this DPA shall prevail. In the event of inconsistencies between this DPA and the SCCs or any other mandatory data transfer clauses applicable under Data Protection Laws, the SCCs or such other clauses will prevail within their scope. All other provisions of the Agreement remain in full force and effect unless expressly modified by this DPA.

Customer By: Name: Title:	Zeus AI Labs, Inc. By: Name: Title:

SCHEDULE 1

Details of Processing

Categories of Data Subjects. This DPA applies to the Processing of Customer Personal Data relating to:

Members: Users who use the Hercules Platform through a Hercules user account as Members of Customer’s Organization(s), which may include Customer’s employees, contractors, agents and other individuals Customer authorizes to use the Hercules Platform, solely to the extent Hercules Processes their Personal Data on Customer’s behalf (for example, within Customer Content, or in administering Customer’s Organization at Customer’s direction).

For clarity, Personal Data that Hercules Processes about Users for its own purposes as an independent Controller, such as Customer Usage Data, account registration, authentication, billing, security and service communications, is governed by the Privacy Policy and is not Customer Personal Data.

End Users: Individuals who access or use Customer Applications or Customer Agents, which may include Customer’s customers, prospective customers, employees, suppliers and other third parties, solely to the extent Hercules Processes their Personal Data on Customer’s behalf (for example, within End User Content).

For clarity, Application Usage Data is governed by the Privacy Policy and is not Customer Personal Data.

Other Individuals: Any other individuals whose Personal Data is contained in Customer Content or End User Content.

Types of Personal Data. Customer Personal Data is limited to any Personal Data contained in Customer Content or End User Content. The extent of the Customer Personal Data Processed by Hercules is determined and controlled by the Customer in its sole discretion and may include: account identifiers, names, email addresses and other contact information; authentication data; IP addresses, device and browser identifiers; Agent Inputs and Agent Outputs; Codebases; records, files and stored outputs; transaction and order information Processed through the Service; and messages, files and business records.

Hercules does not require access to, and Customer will not provide to Hercules, any “special categories” of personal data as defined under Article 9 of GDPR or any other sensitive regulated data (including protected health information, cardholder data subject to PCI-DSS, and data controlled under ITAR), unless separately authorized by Hercules in writing.

Subject-Matter and Nature of the Processing. The subject-matter of Processing of Customer Personal Data by Hercules is the provision of the Service to the Customer, including hosting and operating Customer Applications and Customer Agents, generating Agent Outputs, storing and retrieving Customer Content and End User Content, and providing support requested by Customer. Customer Personal Data will be subject to those Processing activities which Hercules needs to perform in order to provide the Service pursuant to the Agreement.
Purpose of the Processing. Customer Personal Data will be Processed by Hercules for purposes of providing the products and services as set out in the Agreement.
Duration of the Processing. Customer Personal Data will be Processed for the duration of the Agreement and for the applicable return or deletion period set out in Section 9 of the DPA.