Data Protection Addendum

Effective Date:

This Data Protection Addendum (this "Addendum") is a legally binding agreement between you and Powertokens.ai (the "Company", "we", "us" or "our"), governing the processing, access, and use of personal data in connection with your use of the website, platform, documentation, and related services (collectively, the "Services").

By creating an account, accessing the Services, purchasing credits, generating or routing requests through the platform, or otherwise using the Services, you agree to and accept the terms of this Addendum. If you do not agree, you may not access or use the Services.

Terms used in this Data Addendum shall have the meanings set forth in this Data Addendum. Except as supplemented or modified below, the terms of the User Agreement shall remain in full force and effect.

1. Definitions

1.1

"Applicable Data Protection Law" means any law, regulation, or other binding instrument relating to the processing of personal data that applies to the Data Exporter (and any other relevant controller) from time to time, including but not limited to: the Singapore Personal Data Protection Act 2012 (PDPA); the EU General Data Protection Regulation (EU 2016/679) (the "EU GDPR"); the version of the EU GDPR incorporated into the laws of England and Wales, Scotland, and Northern Ireland by the European Union (Withdrawal) Act 2018 (the "UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); U.S. federal and/or state data protection or privacy laws and regulations, including but not limited to the California Privacy Rights Act of 2020, the California Consumer Privacy Act of 2018 (together with its implementing regulations, the "CPRA"), and any other laws and regulations relating to the processing of personal data.

1.2

"Controller" generally means the entity which, alone or jointly with others, determines the purposes and means of the processing of personal data. To the extent that the processing of personal data under this Addendum is subject to Applicable Data Protection Law, it shall have the same meaning as the similar term defined in Applicable Data Protection Law.

1.3

"Data Exporter" means the controller or processor that transfers personal data cross-border pursuant to this Addendum.

1.4

"Data Importer" means the processor located in a different country from the Data Exporter.

1.5

"Data Subject" means any individual whose personal data may be processed pursuant to this Addendum.

1.6

"Personal Data" generally means any information relating to an identified or identifiable natural person that is processed in the course of providing the Services. To the extent that the processing of personal data under this Addendum is subject to Applicable Data Protection Law, it shall have the same meaning as the similar term defined in Applicable Data Protection Law.

1.7

"Process", "Processed" or "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data. For the purposes of this Addendum, the processing activities are carried out in a cross-border manner and therefore include cross-border transfers, i.e., the transfer of personal data by the Data Exporter to the Data Importer located in a different country or region, or the Data Exporter allowing the Data Importer located in a different country or region to process personal data.

1.8

"Processor" generally means the entity which processes personal data on behalf of the Controller. To the extent that the processing of personal data under this Addendum is subject to Applicable Data Protection Law, it shall have the same meaning as the similar term defined in Applicable Data Protection Law.

1.9

"Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.

1.10

"Services" means the services or product offerings as defined in the User Agreement.

1.11

"Personal Data Breach" means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

2. Effective Date

2.1

This Addendum shall become effective on the same effective date as the User Agreement and shall have the same duration.

3. Processing Activities and Roles

3.1

You agree that, unless otherwise permitted under this Addendum, the processing of personal data shall be carried out in accordance with Section 4.1 and, where applicable, other descriptions of processing activities set forth in "Annex I – Specific Jurisdictional Provisions".

3.2

You agree that, for the purpose of providing the Services,

(i)

you act as Controller and hereby agree that PowerTokens and the Model Providers act as Processors and that personal data will be transferred cross-border for processing; and

(ii)

you act as Processor and hereby agree that PowerTokens and the Model Providers act as further Processors (Sub-processors) and that personal data will be transferred cross-border for processing.

4. Obligations of the Parties

The Processor, as Data Importer, shall:

(a)

Process personal data solely for the purpose of providing the Services to you, including but not limited to service delivery, operational support, troubleshooting, data analysis, report generation, and other business functions expressly requested by you. The Processor shall process personal data strictly in accordance with your written instructions throughout the effective term of the Services. Unless the Processor receives further written instructions from you, it shall not process personal data beyond the purposes set forth above. If the Processor reasonably believes that any of your instructions may conflict with Applicable Data Protection Law, it shall promptly notify you. You shall then provide amended or supplemental instructions that comply with Applicable Data Protection Law.

(b)

If Applicable Data Protection Law, court order, subpoena, or other legal or judicial proceeding requires the Processor to process personal data in a manner inconsistent with your instructions, inform you of that legal requirement prior to such processing, unless mandatory applicable law (particularly on grounds of substantial public interest) prohibits such notification.

(c)

Use commercially reasonable efforts to comply with Applicable Data Protection Law relating to cross-border transfers of personal data.

(d)

Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(e)

In the event of a Personal Data Breach involving personal data processed by the Processor under this Addendum, take appropriate measures to address such breach and notify you without undue delay after becoming aware of the breach and its adverse impact on the security of personal data received from you, unless access to or processing of your personal data is in accordance with your instructions.

(f)

Upon termination of this Addendum for any reason, cease processing personal data and, upon your written request,

(i)

return or enable the return of personal data in its possession or control, or

(ii)

securely delete or permanently make existing copies of personal data unreadable or inaccessible; unless continued retention and processing is required or permitted under Applicable Data Protection Law and/or mandatory applicable law.

You, as Data Exporter, shall:

(a)

Comply with Applicable Data Protection Law when using the Services, including ensuring that the collection, storage, and cross-border transfer of your personal data comply with Applicable Data Protection Law, and in particular, that you have obtained any necessary consents/authorizations and otherwise have a lawful basis enabling the Processor to carry out the processing of personal data under this Addendum.

(b)

Ensure that Applicable Data Protection Law, in particular rules relating to cross-border transfers of personal data, does not prevent the Processor from performing this Addendum and carrying out your instructions.

(c)

If you act as a Processor, you shall inform PowerTokens in writing that you are acting as a Processor in accordance with the instructions of your Controller, and you shall provide such instructions to PowerTokens prior to processing. Given that you have a direct relationship with your Controller, you shall be responsible for passing on all information, assistance, and notifications to the Controller in order to fulfill its obligations under Applicable Data Protection Law and the details of the processing of personal data under this Addendum, and for forwarding to PowerTokens all instructions from the Controller regarding the processing of personal data under this Addendum. You shall ensure that your additional instructions do not conflict with the instructions of your Controller.

5. Sub-processing – Applicable to Model Providers

5.1

You hereby grant the Model Providers a general authorization to engage Sub-processors for the purpose of providing the Services to you, which may involve onward transfers of personal data.

5.2

The Model Providers shall maintain an up-to-date list of all Sub-processors, which shall be available on the Model Providers' "Sub-processor webpage". If a Model Provider appoints a Sub-processor, the Model Provider shall ensure that a written agreement is entered into with such Sub-processor containing data protection provisions that provide a level of protection at least equivalent to the provisions of this Addendum. The Model Provider shall notify you of any new Sub-processor appointment by updating the Sub-processor webpage. If you do not raise a written objection (based on reasonable grounds relating to the protection of personal data) within seven (7) days of such update, you shall be deemed to have consented to such appointment.

5.3

If you use the model services of a Model Provider and such Model Provider provides a list of Sub-processors, the provisions of this Section shall apply. For clarity, not all Model Providers provide a list of Sub-processors; whether the Model Provider involved in your use provides a list of Sub-processors shall be governed by the terms on the official website of such Model Provider; you shall consult such terms prior to use. Therefore, regardless of whether the Model Providers have taken reasonable measures to ensure that Sub-processors comply with this Addendum, PowerTokens shall not be liable for any act or omission of the Model Providers and the Sub-processors.

6. Data Subject Requests

6.1

If the Processor directly receives a request from a Data Subject or any person acting on their behalf to exercise rights under Applicable Data Protection Law (a "Data Subject Request"), and the Processor can reasonably identify such request as relating to you and/or your personal data based on the information provided, the Processor shall:

(i)

promptly notify you of such request;

(ii)

not respond to any such request itself unless authorized by the Controller or required by Applicable Data Protection Law; if so required by law, the Processor shall, to the extent permitted by Applicable Data Protection Law, inform you of that legal requirement prior to responding to such request.

6.2

For the avoidance of doubt, PowerTokens and the Model Providers, as Processors or Sub-processors, shall not be responsible for responding to Data Subject Requests. The Services provided by the Processor may contain technical and organizational measures designed, taking into account the nature of the processing, to assist you in fulfilling your obligation to respond to Data Subject Requests to the extent possible. You acknowledge and agree that you are solely responsible for verifying the validity of any Data Subject Request and instructing the Processor accordingly.

6.3

For the avoidance of doubt, nothing in this Addendum waives or alters any rights that Data Subjects may have under Applicable Data Protection Law.

7. Security

7.1

The Parties agree that, during the processing of personal data (including cross-border transfers and onward transfers), appropriate technical and organizational measures shall be taken to ensure the security of personal data under this Addendum.

7.2

The Processor has no obligation to assess the content or accuracy of personal data, including identifying information subject to any particular legal, regulatory, or other requirements, except as otherwise agreed in this Addendum and its Annexes. You are solely responsible for independently determining whether your use of the Services will meet your requirements and your legal obligations under Applicable Data Protection Law.

8. Assistance and Notification

8.1

If you reasonably request assistance from PowerTokens (whether on its own behalf or on behalf of your Controller) for the purpose of fulfilling your legal obligations under Applicable Data Protection Law, or for responding to requests from regulatory authorities, Data Subjects, or other parties for information relating to the processing of personal data by PowerTokens, and PowerTokens or its representatives are able to provide such assistance, PowerTokens shall provide such assistance, unless PowerTokens is prohibited from doing so by Applicable Data Protection Law. PowerTokens reserves the right to charge you a reasonable fee for such requested assistance.

8.2

All information provided for the purpose of providing assistance under Section 8.1 shall be the confidential information of PowerTokens and shall not be disclosed without PowerTokens' prior written consent, unless required by mandatory applicable law.

8.3

Any notification or response under Section 4.1(e) shall not be deemed an acknowledgment of any fault or liability on the part of the Processor or Sub-processor with respect to the performance of the Services.

The Parties agree that: any notice, instruction, document, or other communication relating to this Addendum shall be invalid unless it satisfies the following conditions:

(a)

In writing;

(b)

In English or accompanied by an English translation (in the event of any conflict, the English translation shall prevail);

(c)

Delivered or sent by [mail, courier service, facsimile, electronic communication] or any other means capable of transmitting written communications in a legible and permanent form.

9. Liability

9.1

You shall be liable to PowerTokens for damages arising from a breach of this Addendum. In no event shall PowerTokens be liable for any indirect, special, incidental, or consequential damages arising from all Personal Data Breaches and any breach of this Addendum, including but not limited to loss of business or reputational damage.

9.2

Except to the extent that liability cannot be limited or excluded under mandatory applicable law, the total aggregate liability of PowerTokens for all Personal Data Breaches and any breach of this Addendum (whether based on contract, misrepresentation, negligence, strict liability, or any other legal theory) shall not exceed US$10,000.

9.3

In addition, except in the case of intentional misconduct or gross negligence, the total aggregate liability of PowerTokens for all claims arising out of this Addendum shall be capped at US$50,000.

10. Governing Law and Jurisdiction

10.1

You irrevocably agree that any claim, dispute, or controversy arising out of or in connection with this Addendum or any Order Form (a "Dispute"), including disputes concerning the existence, formation, validity, interpretation, performance, or termination of this Addendum or any Order Form or the consequences of its nullity, as well as any non-contractual rights or obligations arising out of, in connection with, or having any link to this Addendum or any Order Form, shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) in accordance with the Arbitration Rules of the Singapore International Arbitration Centre for the time being in force, which rules are deemed to be incorporated by reference into this Section 10. The seat of the arbitration shall be Singapore. The arbitral tribunal shall consist of three (3) arbitrators. Each party shall nominate one (1) arbitrator, and the two arbitrators nominated by the parties shall jointly nominate the third (3rd) arbitrator, who shall act as the presiding arbitrator. If any party fails to nominate its arbitrator, or if the arbitrators nominated by the parties fail to agree on the presiding arbitrator within fourteen (14) days, such appointment(s) shall be made by the President of the SIAC. The language of the arbitration shall be English.

Annex I – Specific Jurisdictional Provisions

Depending on the Applicable Data Protection Law that may apply to the cross-border transfer of personal data between the Parties, certain specific jurisdictional provisions shall apply. In the event of any gap in this Addendum, or any inconsistency between the applicable specific jurisdictional provisions and this Addendum, the applicable specific jurisdictional provisions shall prevail.

European Economic Area (the "EEA"), Switzerland or the United Kingdom

Where personal data originating from the EEA, Switzerland, or the United Kingdom is transferred to a jurisdiction that has not been recognized as providing an adequate level of data protection, the Parties agree that such transfer shall be governed by the Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "SCCs"). In the SCCs, the following shall apply specifically:

(a)

When you act as Controller, Module Two: Controller-to-Processor Transfers shall apply.

(b)

When you act as Processor, Module Three: Processor-to-Processor Transfers shall apply.

(c)

The Parties agree to incorporate Clause 7 (Docking Clause).

(d)

In Clause 9 (Use of Sub-processors), paragraph (a):

Module Two: Controller-to-Processor Transfers: You agree to incorporate Option 2: General written authorization.

Module Three: Processor-to-Processor Transfers: You agree to incorporate Option 2: General written authorization.

(e)

In Clause 11 (Redress), paragraph (a): You do not agree to incorporate this option.

(f)

In Clause 17 (Governing Law): The applicable option shall be mutually agreed upon by the Parties and incorporated accordingly.

(g)

In Clause 18 (Choice of forum and jurisdiction), paragraph (b): The applicable court and jurisdiction shall be mutually agreed upon by the Parties and incorporated accordingly.

DESCRIPTION OF THE TRANSFER

Categories of Data Subjects whose personal data are transferred from you:

End users of the Services (natural persons)

Categories of personal data transferred:

Service Data: Content (e.g., text, images, video) submitted via the API for processing. Personal data (e.g., facial data and voice data) is processed in accordance with applicable law.

Sensitive data transferred (if applicable) and applicable restrictions or safeguards that fully take into account the nature of the data and the risks involved, such as strict purpose limitation, access restrictions (including access limited to specially trained staff), maintaining records of access to data, restrictions on onward transfers, or additional security measures:

Photographs or videos that may contain biometric data.

Frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis):

Data is transferred continuously during the end user's use of the Services.

Nature of the processing:

Storage, recording, combination, classification, analysis, and generation for the purpose of providing the Services.

Purpose(s) of the data transfer and further processing:

Provision and maintenance of the Services, etc.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:

The retention period is based on service requirements, legal requirements, fraud prevention, and record-keeping obligations.

For transfers to (sub-)processors, also specify the subject matter, nature, and duration of the processing:

Please refer to Section 5 of this Addendum for further details.

Competent Supervisory Authority

Determination of the competent supervisory authority pursuant to Clause 13:

The data protection commission of the relevant jurisdiction as determined pursuant to Clause 13 of the EU SCCs.

Annex II – Technical and Organisational Measures Including Measures to Ensure Data Security

(a)

Data Security. Implementation of:

Data classification and grading standards;
A suite of authentication and access control capabilities at the physical, network, system, and application levels; and
Mechanisms for detecting anomalous behavior based on big data analytics.

(b)

Network Security. Implementation of strict internal network isolation rules, with access control and boundary protection for internal networks (including office networks, development networks, testing networks, and production networks) achieved through physical and logical isolation.

(c)

Physical and Environmental Security. Implementation of strict infrastructure and environmental access controls for data access based on relevant regional security requirements. An access control matrix is established based on personnel types and their respective access permissions to ensure effective management and control of access and operating personnel.

(d)

Incident Management. Operation of proactive, real-time service monitoring combined with rapid response and handling mechanisms to enable timely detection and resolution of security incidents.

(e)

Standards Compliance. Compliance with the following standards:

Information Security Management System (ISMS) – ISO/IEC 27001:2022.
Privacy Information Management System (PIMS) – ISO/IEC 27701:2025.

Loading PowerTokens

Wait a moment...