Data Processing Addendum

Effective Date: October 11, 2026 | Last Updated: October 11, 2026 Thomas Abram, LLC | privacy@abram.network

This Data Processing Addendum ("DPA") is between Thomas Abram, LLC, a Delaware limited liability company ("ABRAM"), and the organization that uses the ABRAM platform under the ABRAM Terms of Use or another written agreement with ABRAM ("Customer"). It forms part of that agreement (the "Agreement").

How this DPA takes effect. This DPA applies automatically, with no signature needed, from the earlier of the date Customer accepts the Agreement and the date ABRAM first processes Customer Personal Data. Customers who want a countersigned copy for their records can request one from legal@abram.network. A countersigned copy has the same terms as this page on the date it is signed.

1. Definitions

Terms defined in the GDPR have the same meaning in this DPA.

• "Data Protection Law" means the GDPR (Regulation (EU) 2016/679), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and United States state privacy laws, each to the extent it applies to the processing.
• "Customer Personal Data" means personal data that ABRAM processes on Customer's behalf in providing the platform to Customer.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• "Sub-processor" means a third party ABRAM engages to process Customer Personal Data.

2. Roles and Scope

2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller. ABRAM is Customer's processor, or sub-processor where Customer is itself a processor.

2.2 This DPA does not cover personal data that ABRAM processes as a controller for its own purposes, such as account administration, billing, security, product analytics and ABRAM's own communications. ABRAM's Privacy Policy covers that processing.

2.3 Work profiles. Section 17.3 of the Terms of Use authorizes ABRAM to use records of work done in Customer's workspace by people who hold their own ABRAM accounts to build each person's cross-workspace work profile, as described in Section 4.6 of the Privacy Policy. ABRAM does that processing as an independent controller, within the limits Section 17.3 sets, and it is outside this DPA. Every other use of Customer Personal Data is governed by this DPA.

3. Details of Processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Customer's Instructions

4.1 ABRAM processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the platform are Customer's complete instructions at the effective date. Further instructions must be in writing and consistent with the Agreement.

4.2 ABRAM processes Customer Personal Data otherwise only where law requires it, and in that case tells Customer first, unless the law forbids it.

4.3 ABRAM tells Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

5. Customer's Obligations

5.1 Customer is responsible for having a lawful basis for the Customer Personal Data it puts into the platform, for giving the people concerned any notice the law requires, and for the accuracy of that data.

5.2 Customer does not put special category data, criminal offence data, government identification numbers or payment card numbers into the platform unless the platform provides a field designed for it.

6. ABRAM's Obligations

6.1 Confidentiality. Everyone ABRAM authorizes to process Customer Personal Data is bound by an obligation of confidentiality. ABRAM's automated agents that can reach Customer Personal Data work under ABRAM's documented controls, and a person approves their changes before they take effect.

6.2 Security. ABRAM implements the technical and organizational measures in Annex 2 and keeps them appropriate to the risk, as Article 32 of the GDPR requires. ABRAM may update the measures, provided the overall level of protection does not decrease.

6.3 Records. ABRAM keeps a record of the processing it carries out on Customer's behalf, as Article 30(2) of the GDPR requires.

7. Sub-processors

7.1 Customer gives ABRAM general written authorization to engage Sub-processors. The Sub-processors at the effective date are listed at abram.network/subprocessors, which forms Annex 3.

7.2 ABRAM gives at least 30 days' notice before a new or replacement Sub-processor processes Customer Personal Data. Notice is given by updating the list in 7.1 and by email to everyone who has asked for notices by writing to privacy@abram.network.

7.3 Customer may object to a new Sub-processor on reasonable data protection grounds by writing to privacy@abram.network within the notice period. The parties then discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the service by written notice, and ABRAM refunds any prepaid fees for the remainder of the term of that part.

7.4 Where a Sub-processor must be replaced urgently to protect security or continuity of the service, ABRAM may make the change first and gives notice as soon as possible, with the reason. Section 7.3 then applies.

7.5 ABRAM binds each Sub-processor by written contract to data protection obligations no less protective than this DPA, and remains liable to Customer for each Sub-processor's performance of those obligations. The one exception is Anthropic's Claude subscription service used by ABRAM's internal AI agents, which works under Anthropic's terms for that service, with model training turned off, and is identified as an exception on the list in 7.1. ABRAM remains responsible to Customer for that processing as if it were ABRAM's own.

8. Requests From Data Subjects

8.1 The platform lets Customer access, export, correct and delete Customer Personal Data. ABRAM gives further reasonable help, taking into account the nature of the processing, so that Customer can respond to requests from data subjects.

8.2 If ABRAM receives a request about Customer Personal Data directly, it passes the request to Customer within 5 business days and does not answer it, except to tell the person that it has passed the request on, unless Customer instructs otherwise. Requests about a cross-workspace work profile under Section 2.3 are answered by ABRAM.

9. Assistance

ABRAM gives Customer reasonable help with Customer's obligations under Articles 32 to 36 of the GDPR, including information for Customer's data protection impact assessments and any prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to ABRAM.

10. Personal Data Breach

10.1 ABRAM notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Notice goes to the email addresses of Customer's organization owners.

10.2 The notice describes, as far as then known, the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact. ABRAM supplements the notice as more becomes known.

10.3 ABRAM takes reasonable steps to contain and remedy the breach. ABRAM does not notify a supervisory authority or data subjects on Customer's behalf unless Customer instructs it to in writing.

10.4 ABRAM's notice of a breach is not an admission of fault or liability.

11. Deletion and Return

11.1 During the term of the Agreement, Customer can export and delete Customer Personal Data using the platform.

11.2 When the Agreement ends, ABRAM keeps Customer Personal Data available for export for 30 days and then deletes it within a further 30 days, unless law requires ABRAM to keep it. Copies in backups are deleted as the backups expire on the provider's schedule and are not restored to use in the meantime. ABRAM confirms deletion in writing on request.

12. Audits

12.1 ABRAM makes available the information reasonably necessary to demonstrate its compliance with this DPA, including its security and privacy policies, completed security questionnaires, and independent audit reports once they exist.

12.2 Where that information is not enough, or a supervisory authority requires it, Customer, or an independent auditor bound by confidentiality, may audit ABRAM's compliance with this DPA no more than once in any 12 months (or again after a Personal Data Breach), on at least 30 days' written notice, during business hours, remotely unless an on-site visit is unavoidable, and at Customer's cost. Audits do not extend to other customers' data or to Sub-processors' facilities, whose own reports ABRAM makes available where it is permitted to.

13. International Transfers

13.1 Customer Personal Data is stored in the United States (Annex 1). Where Data Protection Law treats Customer's provision of Customer Personal Data to ABRAM as a restricted transfer, the SCCs apply and are incorporated into this DPA by reference, as follows:

• Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor;
• Clause 7 (docking clause) applies;
• Clause 9: option 2 (general written authorization), with the notice period in Section 7.2;
• Clause 11: the optional language does not apply;
• Clause 13: the competent supervisory authority is the one identified in Annex 1, part C;
• Clause 17: option 1, the law of Ireland; Clause 18: the courts of Ireland;
• Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.

13.2 For transfers subject to the UK GDPR, the UK Addendum applies and is incorporated by reference. Tables 1 to 3 are completed by the selections in 13.1 and by Annexes 1 to 3 of this DPA. For Table 4, neither party may end the UK Addendum under its Section 19.

13.3 For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with these adjustments: references to the GDPR are read as references to the Swiss Federal Act on Data Protection; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; and the term "member state" in Clause 18(c) does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

13.4 If ABRAM certifies to the EU-US Data Privacy Framework or another adequacy mechanism, the parties may rely on it instead, and the SCCs remain in place as a fallback. ABRAM is not certified at the effective date of this DPA.

13.5 ABRAM's Sub-processors are bound under Section 7.5, and use the transfer mechanisms recorded for them on the list in Annex 3.

14. United States State Privacy Laws

Where Customer Personal Data is subject to United States state privacy laws, ABRAM acts as Customer's service provider or processor. ABRAM does not sell or share Customer Personal Data, as those terms are defined in those laws. Except for the processing described in Section 2.3, ABRAM does not retain, use or disclose Customer Personal Data outside the direct business relationship with Customer or for any purpose other than providing the platform, and does not combine it with personal data from other sources except as those laws permit. ABRAM tells Customer if it can no longer meet these obligations, and Customer may then take reasonable steps to stop and remedy unauthorized processing.

15. General

15.1 Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Law or the SCCs do not allow it.

15.2 If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails. If it conflicts with the SCCs or the UK Addendum, they prevail.

15.3 This DPA lasts as long as ABRAM processes Customer Personal Data. ABRAM may update this DPA under Section 19 of the Terms of Use, but no update reduces the protection this DPA gives Customer Personal Data without Customer's agreement, unless Data Protection Law requires the change.

Annex 1. Details of Processing

A. Parties.

• Data exporter: Customer, as identified in its ABRAM account, contactable through the email addresses of its organization owners. Role: controller, or processor for its own controller.
• Data importer: Thomas Abram, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, US. Contact: privacy@abram.network. Role: processor.

B. Description of the processing.

C. Competent supervisory authority. The supervisory authority of the EU member state in which Customer is established. Where Customer is not established in the EU, the supervisory authority of the member state in which the data subjects whose personal data is transferred are located. For transfers under the UK GDPR, the Information Commissioner's Office. For transfers under Swiss law, the Federal Data Protection and Information Commissioner.

Annex 2. Technical and Organizational Measures

• Tenant isolation and access control. Row-level security in the database separates each organization's data. Organization roles and permissions limit what each member can see and do. Access to the production database is limited to ABRAM's founder and to ABRAM's automated agents working under documented controls, and actions taken through ABRAM's staff tools are logged with a reason.
• Authentication. Sign-in through WorkOS. Single sign-on and SCIM directory sync are available on plans that include them, and multi-factor authentication follows Customer's identity provider or WorkOS settings.
• Encryption. TLS 1.2 or higher in transit. Encryption at rest by the infrastructure providers.
• AI controls. AI actions that contact people, change access, delete data or move money wait for a person's approval. Customer Personal Data is not used to train shared AI models without the separate consent described in Section 6.2 of the Terms of Use. On the Enterprise plan, ABRAM switches off every AI feature for an organization at an owner's request.
• Logging and monitoring. Administrative actions by ABRAM personnel and by organization members are logged. Automated compliance monitors run daily.
• Secure development. Automated checks for row-level security, privileged database functions and committed secrets run on code changes.
• Vulnerability management. Remediation targets of 14 days for critical, 30 days for high and 90 days for medium severity findings. A public vulnerability disclosure contact at security@abram.network.
• Incident response. A documented incident response plan, including breach assessment and the notice in Section 10.
• Business continuity. A documented business continuity and recovery plan.
• Sub-processor management. Every Sub-processor is listed publicly and bound by written data processing terms.
• Data minimization and retention. A retention schedule implemented by scheduled deletion jobs, and an erasure process for account deletion.
• Personnel. Confidentiality obligations for everyone with access to Customer Personal Data.

Annex 3. Sub-processors

The Sub-processors listed at abram.network/subprocessors on the relevant date, with the purpose, the data each receives and the region it operates in.

Contact

Thomas Abram, LLC

Privacy: privacy@abram.network Legal and countersigned copies: legal@abram.network Mailing address: 131 Continental Dr, Suite 305, Newark, DE 19713, US

© 2026 Thomas Abram, LLC. All rights reserved.