Effective date August 18, 2026

Helpwan Standard Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the written or electronic agreement, order form, engagement confirmation, subscription agreement, or other contract (the “Agreement”) under which Helpwan provides its services to the customer or contracting partner identified in that Agreement (“Customer”).

This DPA is entered into between:

1. Helpwan Corporation OÜ, an Estonian private limited company, registry code 17119515, with its registered office at Narva mnt 7-652, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia (“Helpwan”); and
2. Customer, as identified in the Agreement.

This DPA takes effect when the Agreement takes effect. No separate signature is required if the Agreement incorporates or links to this DPA. If the parties sign this DPA separately, it takes effect on the date of the last signature.

1. Definitions

1.1. Applicable Data Protection Law means the GDPR and, where applicable, the UK GDPR, the UK Data Protection Act 2018, and other data-protection law that applies to the processing under the Agreement.

1.2. Customer Personal Data means personal data that Helpwan processes on behalf of Customer under the Agreement.

1.3. GDPR means Regulation (EU) 2016/679.

1.4. Personal Data Breach, controller, processor, data subject, personal data, processing, and supervisory authority have the meanings given in Applicable Data Protection Law.

1.5. Services means the Helpwan platform and related implementation, diagnosis, expert-validation, support, and other services specified in the Agreement.

1.6. Subprocessor means a third party appointed by or for Helpwan to process Customer Personal Data in connection with the Services.

2. Scope and roles

2.1. This DPA applies only where Helpwan processes Customer Personal Data on behalf of Customer.

2.2. The parties’ roles depend on Customer’s relationship with the relevant controller:

• where Customer determines the purposes and means of processing, Customer is the controller and Helpwan is the processor;

• where Customer processes personal data for another controller, Customer is a processor and Helpwan is Customer’s subprocessor.

  2.3. Customer represents that:

• it has authority to give Helpwan the instructions set out in the Agreement and this DPA;

• its instructions comply with Applicable Data Protection Law; and

• where Customer is a processor, the relevant controller has authorised Customer to appoint Helpwan and Helpwan’s authorised Subprocessors.

  2.4. Each party is an independent controller for personal data that it processes for its own account-management, billing, legal-compliance, fraud-prevention, security, or business-administration purposes. This DPA does not govern that independent processing.

3. Customer instructions

3.1. Helpwan will process Customer Personal Data only:

• on Customer’s documented instructions;

• as necessary to provide, secure, support, and maintain the Services;

• as configured or used by Customer and its authorised users; and

• as required by applicable law.

  3.2. The Agreement, this DPA, the Service configuration, and Customer’s lawful written requests are Customer’s documented instructions.

  3.3. If applicable law requires Helpwan to process Customer Personal Data outside Customer’s instructions, Helpwan will inform Customer before that processing unless the law prohibits the notice.

  3.4. Helpwan will promptly inform Customer if, in Helpwan’s reasonable opinion, an instruction infringes Applicable Data Protection Law. Helpwan may suspend the affected processing until Customer changes or confirms the instruction.

  3.5. Customer will not provide data described in Section 4.6 unless the parties first agree in writing to the processing and the required safeguards.

  3.6. Helpwan will not use Customer Personal Data to train, fine-tune, or improve any general-purpose or foundation model; any aggregate/benchmark use is limited to irreversibly anonymised data. Helpwan contracts with its AI service providers on terms that prohibit retention or training on Customer Personal Data.

4. Processing details

4.1. Subject matter: provision of the Services under the Agreement.

4.2. Duration: the term of the Agreement, plus the limited period needed to return or delete data, complete backup rotation, comply with law, maintain security, or establish, exercise, or defend legal claims.

4.3. Nature and purposes: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, analysis, matching, scoring, expert validation, transmission, combination, restriction, pseudonymisation, export, deletion, and destruction, as necessary to provide the Services. This can include workforce-readiness diagnosis, employee-evidence analysis, recommendations, implementation support, reporting, support, security, and backups.

4.4. Categories of data subjects: Customer employees, workers, managers, human-resources personnel, contractors, consultants, job candidates where agreed, authorised users, and other persons whose data Customer submits to the Services.

4.5. Types of personal data:

• names, business contact details, user identifiers, account and authentication data;

• job title, role, department, reporting relationships, location, and organisational data;

• professional history, skills, qualifications, experience, CV information, objectives, assessments, feedback, development, mobility, performance-related inputs, and readiness evidence;

• survey, interview, meeting, recording, transcription, document, and free-text content submitted by Customer or authorised users;

• usage, device, browser, IP-address, audit, support, and security metadata; and

• other personal data that Customer lawfully submits under the Agreement.

  4.6. The Services are not intended to process, unless expressly agreed in writing:

• special categories of personal data under GDPR Article 9;

• criminal-conviction or offence data under GDPR Article 10;

• data about children; or

• regulated health, payment-card, or other sector-specific data.

  4.7. Customer instructs Helpwan, and Helpwan is authorised, to take the following steps where Helpwan detects data described in Section 4.6 that has not been approved in writing: (a) restrict or quarantine the affected data; (b) request that Customer remove it; or (c) remove or delete it where reasonably necessary to protect the Services, other customers, the affected data subjects, or to comply with law. This Section 4.7 constitutes a documented instruction of Customer for the purposes of Section 3.2. Helpwan will notify Customer without undue delay of any action taken under this Section where legally and technically possible, and will not exercise limb (c) in respect of data that Customer has instructed Helpwan in writing to retain, save where required by law.

  4.8. The Services are not designed, configured, or operated to infer, derive, predict, or generate special categories of personal data within the meaning of GDPR Article 9, criminal-conviction or offence data within the meaning of GDPR Article 10, or any proxy for such data.

5. Confidentiality and personnel

5.1. Helpwan will ensure that each person authorised to process Customer Personal Data:

• is bound by an appropriate duty of confidentiality;

• processes the data only as needed for their duties and Customer’s instructions; and

• receives appropriate privacy and security guidance.

  5.2. Helpwan will limit access to authorised persons according to least-privilege principles.

6. Security

6.1. Taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and the risk to individuals, Helpwan will implement and maintain technical and organisational measures appropriate to the risk, as required by Article 32 GDPR.

6.2. Helpwan will select and adjust those measures according to the relevant processing and risk. They will be designed to support, as appropriate:

• the confidentiality, integrity, availability, and resilience of systems and services that process Customer Personal Data;

• restoration of availability and access after an incident;

• access limited to authorised persons;

• protection of data during transmission and storage; and

• regular evaluation of whether the measures remain appropriate.

  6.3. Helpwan may modify its measures as technology, the Services, and risks change, provided that the overall level of protection is not materially reduced during the term of the Agreement.

  6.4. On reasonable request, Helpwan will provide Customer with a current description of the measures relevant to Customer Personal Data. Any description is subject to reasonable confidentiality and security restrictions.

  6.5. Current general security information is available at https://www.helpwan.com/security/. Public information describes Helpwan’s practices but does not expand this DPA unless expressly incorporated into the Agreement.

7. Personal Data Breaches

7.1. Helpwan will notify Customer without undue delay and no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. If notification is not made within 48 hours, Helpwan will include reasons for the delay.

7.2. The notice will include, as information becomes available:

• the nature of the breach;

• the affected data and approximate categories and number of data subjects and records;

• likely consequences;

• measures taken or proposed to contain, investigate, and mitigate the breach; and

• a contact point for further information.

  7.3. Helpwan may provide information in stages. A notice is not an admission of fault or liability.

  7.4. Helpwan will take reasonable measures to contain, investigate, mitigate, and remediate the breach and will reasonably assist Customer with notices required by Applicable Data Protection Law.

8. Data-subject requests and compliance assistance

8.1. Taking into account the nature of the processing, Helpwan will provide reasonable technical and organisational assistance for Customer to respond to data-subject requests.

8.2. If Helpwan receives a request directly concerning Customer Personal Data, Helpwan will, unless legally prohibited:

• refer the requester to Customer; or

• forward the request to Customer without responding substantively.

  8.3. Taking into account the nature of processing and the information available to Helpwan, Helpwan will reasonably assist Customer in complying with its obligations under GDPR Articles 32 to 36, including security of processing, personal data breach notification and communication, data-protection impact assessments, and prior consultation with a supervisory authority.

  8.4. Helpwan may charge reasonable fees for assistance that is unusually extensive, repetitive, or outside the normal operation of the Services. Helpwan will give advance notice of those fees where practicable. Helpwan will not charge for the documentation described in Section 8.6.1 or for assistance falling within the normal operation of the Services.

  8.5. Automated decision-making and profiling.

  8.5.1. The Services are designed to produce decision-support outputs, including skills inferences, matches, recommendations, and indicative scores, intended to inform decisions taken by Customer. The Services are not designed to take decisions on behalf of Customer.

  8.5.2. Helpwan will not configure the Services to produce a decision based solely on automated processing that produces legal effects concerning a data subject or similarly significantly affects a data subject, within the meaning of GDPR Article 22(1).

  8.5.3. Customer is responsible for ensuring that any decision informed by Service outputs involves meaningful human review by a person with the competence and authority to reach a different conclusion, and for determining the lawful basis and safeguards for any processing that does engage Article 22. Customer will not configure or use the Services to implement solely automated decision-making without first notifying Helpwan in writing and agreeing the required additional safeguards.

  8.5.4. Helpwan will notify Customer before making a material change to the Services that would alter the degree of automation in any output described in Section 8.5.1.

  8.6. Transparency and explanation support.

  8.6.1. Helpwan will make available to Customer documentation describing, at a level sufficient for Customer to meet its obligations under GDPR Articles 13(2)(f), 14(2)(g), and 15(1)(h): (a) the categories of input data used to generate each material output of the Services; (b) meaningful information about the logic involved, in intelligible terms; (c) the intended purpose and the significance and envisaged consequences of the processing for data subjects; and (d) known limitations.

  8.6.2. Where a data subject exercises a right to obtain human intervention, to express a point of view, or to contest a decision informed by Service outputs, Helpwan will provide reasonable technical assistance to enable Customer to identify the inputs and factors that materially contributed to the relevant output.

  8.6.3. Helpwan will review and, where necessary, update the documentation described in Section 8.6.1 at least annually and following any material change to the logic of the Services.

9. Subprocessors

9.1. Customer gives Helpwan general written authorisation to appoint Subprocessors.

9.2. Helpwan will maintain a current list of Subprocessors at https://www.helpwan.com/subprocessors/ or a successor URL notified to Customer.

9.3. Helpwan will give at least 30 days’ prior notice of a new or replacement Subprocessor that will process Customer Personal Data. Notice may be by email, through the Services, or through a change-notification mechanism on the Subprocessor page.

9.4. Customer may object during that notice period on reasonable and documented data-protection grounds. The parties will work in good faith to find a commercially reasonable solution. If no solution is reasonably available, Helpwan may avoid using that Subprocessor for Customer, or either party may terminate only the affected Service without penalty and with a refund of prepaid fees for the unused affected period.

9.5. Helpwan will enter into written terms with each Subprocessor that impose data-protection obligations that are no less protective in substance than the obligations applicable to that Subprocessor’s processing under this DPA.

9.6. Helpwan remains responsible for each Subprocessor’s performance to the extent required by Applicable Data Protection Law.

10. International transfers

10.1. Helpwan’s primary application hosting and databases are located in the European Economic Area. Some authorised Subprocessors or support operations may process data outside the EEA or the UK, as listed in the Subprocessor documentation.

10.2. Helpwan will not make a restricted transfer of Customer Personal Data unless it uses a valid transfer mechanism, such as:

• an adequacy decision;

• the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“EU SCCs”);

• the UK International Data Transfer Addendum to the EU SCCs (“UK Addendum”); or

• another lawful mechanism under Applicable Data Protection Law.

  10.3. Transfer mechanisms and incorporation of the EU SCCs.

  10.3.1. Where a transfer of Customer Personal Data under the Agreement constitutes a restricted transfer for which no adequacy decision or other lawful mechanism under Section 10.2 applies, the EU SCCs are incorporated into this DPA by reference and apply to that transfer, in the module identified in Section 10.3.2.

  10.3.2. The applicable module is determined by the roles of the parties in the relevant transfer:

• Module Three (processor to processor) applies where Helpwan, acting as processor or subprocessor, transfers Customer Personal Data to a Subprocessor established outside the EEA. Helpwan is the data exporter and the Subprocessor is the data importer;

• Module Four (processor to controller) applies where Helpwan, acting as processor and subject to the GDPR, transfers Customer Personal Data to Customer where Customer is a controller established outside the EEA in a country not benefiting from an adequacy decision. Helpwan is the data exporter and Customer is the data importer;

• where Customer acts as a processor for another controller and is established outside the EEA, Module Three applies mutatis mutandis to transfers from Helpwan to Customer, with Helpwan as data exporter.

  10.3.3. The following elections apply to each incorporated module:

• Clause 7 (docking clause) applies;

• for Module Three, Option 2 (general written authorisation) applies to Clause 9, and the notice period is the period stated in Section 9.3 of this DPA;

• the optional language in Clause 11(a) does not apply;

• Option 1 applies to Clause 17, and the governing law is the law of Estonia;

• the courts of Estonia are the chosen forum under Clause 18;

• the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) is the competent supervisory authority under Clause 13, unless Applicable Data Protection Law requires a different authority, in which case that authority applies;

• for Module Three, Annex I.A is completed by the party details in the preamble of this DPA and the Agreement; Annex I.B by Sections 2 and 4 of this DPA; Annex I.C by the supervisory authority identified above; Annex II is completed by the current description of measures Helpwan provides under Section 6.4 for the relevant transfer; and Annex III (where applicable) by the Subprocessor list referenced in Section 9.2;

• for Module Four, Annex I.A and I.B are completed as above, and Annex II applies only to the extent the transferred data remains subject to Chapter V of the GDPR in the hands of the data importer.

  10.3.4. Where Module Four applies, Customer as data importer will process the transferred Customer Personal Data in accordance with Clauses 8.1 and 8.2 of Module Four and will not subject it to processing that infringes the rights of data subjects under Applicable Data Protection Law.

  10.3.5. Helpwan will put in place Module Three of the EU SCCs, or another lawful transfer mechanism, with each Subprocessor established outside the EEA before that Subprocessor processes Customer Personal Data, and will make evidence of that mechanism available to Customer on reasonable request under Section 12.

  10.3.6. Where more than one module could apply to a single transfer, the module reflecting the actual roles of the parties in that transfer prevails. If the parties’ roles change, the applicable module changes accordingly without further action.

  10.4. For a restricted transfer from the UK, the parties incorporate the then-current UK Addendum. The information in this DPA and the EU SCCs completes its tables as far as applicable. Neither party may terminate the UK Addendum solely because the UK Information Commissioner issues a revised form; the revised form will apply as required by law. For the purposes of Table 4 of the UK Addendum, neither party may end the UK Addendum as set out in Section 19 of that Addendum.

  10.5. Helpwan will provide reasonable information needed for Customer’s transfer assessment and will implement supplementary measures where required and reasonably available.

11. Return and deletion

11.1. During the term, Customer may use available Service functions to access or export Customer Personal Data, subject to the Agreement and technical limits.

11.2. On termination, and on Customer’s written request made within 60 days, Helpwan will provide a reasonable export of Customer Personal Data or delete it, at Customer’s choice, unless law requires retention.

11.3. If Customer gives no instruction during that period, Helpwan may delete or irreversibly anonymise the data.

11.4. Data in backups will be protected and deleted through Helpwan’s normal backup-rotation cycle. Helpwan will not restore or process it except for recovery, security, or legal requirements.

11.5. On request, Helpwan will confirm completion of deletion, subject to legally required retention and backup rotation.

12. Information and audits

12.1. Helpwan will make available information reasonably necessary to demonstrate compliance with this DPA and GDPR Article 28.

12.2. Customer must first use available independent reports, certifications, security documentation, questionnaires, and written evidence where these reasonably satisfy the audit need.

12.3. If that information is not reasonably sufficient, Customer may audit Helpwan’s relevant controls no more than once in any 12-month period, unless a confirmed Personal Data Breach, a reasonable basis to suspect material non-compliance, or a supervisory-authority requirement justifies an additional audit.

12.4. An audit must:

• give at least 30 days’ prior written notice where practicable;

• occur during normal business hours;

• be limited to systems and records relevant to Customer Personal Data;

• avoid unreasonable disruption and access to other customers’ data;

• be conducted by Customer or an independent auditor that is not Helpwan’s competitor and is bound by confidentiality; and

• comply with reasonable security and access rules.

  12.5. Customer bears its audit costs. Helpwan may charge reasonable costs for support beyond ordinary compliance assistance, unless the audit identifies a material breach by Helpwan.

  12.6. Helpwan will inform Customer if, in Helpwan’s opinion, an audit instruction infringes Applicable Data Protection Law.

13. Records and regulatory cooperation

13.1. Helpwan will maintain the processor records required by GDPR Article 30(2).

13.2. Helpwan will cooperate with the competent supervisory authority as required by Applicable Data Protection Law.

14. Liability

14.1. Each party’s liability arising from this DPA is subject to the exclusions and limits in the Agreement, to the maximum extent permitted by law.

14.2. Nothing in this DPA limits a data subject’s rights or a supervisory authority’s powers under Applicable Data Protection Law.

14.3. Where the Agreement contains no limitation of liability, Helpwan’s aggregate liability under this DPA is limited to the greater of EUR 10,000 and the fees paid under the Agreement in the 12 months preceding the claim. This Section 14.3 does not apply to liability arising from wilful misconduct or gross negligence, or to liability that cannot be limited under applicable law.

15. Order of precedence

15.1. If documents conflict regarding the protection or processing of personal data, the following order applies:

1. the EU SCCs or UK Addendum, where applicable;

2. this DPA;

3. Annex D of this DPA;

4. the Agreement; and

5. other Service documentation.

   15.2. An engagement confirmation or order form can supplement the processing details but does not reduce the protections in this DPA unless Applicable Data Protection Law permits it and the change is explicit.

16. Term and termination

16.1. This DPA remains effective while Helpwan processes Customer Personal Data.

16.2. Material breach of this DPA is a material breach of the Agreement. The termination and cure provisions in the Agreement apply.

16.3. Sections that by their nature must continue will survive termination, including confidentiality, breach cooperation, deletion, audit, transfers, liability, and precedence.

16.4. Helpwan reserves the right to modify the terms of this DPA provided that no amendment materially reduces the protections applicable to Customer Personal Data. Any material amendments will become effective 30 days following the date of notice provided to Customer and the publication of the updated version. The specific version in force at the time of the Agreement’s commencement shall govern until the conclusion of said notice period. Archive copies of prior versions may be consulted at https://www.helpwan.com/dpa/all/.

17. Governing law and notices

17.1. Except where the EU SCCs, UK Addendum, or mandatory law provides otherwise, this DPA is governed by Estonian law and disputes are subject to the courts specified in the Agreement or, if the Agreement is silent, Harju County Court, Estonia.

17.2. Data-protection notices to Helpwan must be sent to privacy@helpwan.com.

17.3. Notices to Customer will be sent to the contact stated in the Agreement or the Service account.

Annex A — Processing description

The processing description is in Section 4. The Agreement and relevant order form or engagement confirmation can add:

• the specific Services and modules;
• the authorised data sets and integrations;
• approved special-category processing, if any;
• retention or export requirements that differ from the standard Service operation;
• approved experts or other engagement-specific Subprocessors; and
• deployment region or transfer restrictions.

Annex B — Technical and organisational measures

Section 6 governs Helpwan’s technical and organisational measures.

Where the EU Standard Contractual Clauses apply to a restricted transfer, the parties will complete the SCC Annex II with a current, specific description of the measures relevant to that transfer. Helpwan may provide that description in controlled security documentation rather than publish operational security details in this DPA.

Annex C — Authorised Subprocessors

The current list is maintained at https://www.helpwan.com/subprocessors/. Or by request at privacy@helpwan.com.

Annex D — EU AI Act Addendum

D1. Scope and purpose

D1.1. This Annex sets out the parties’ respective responsibilities under Regulation (EU) 2024/1689 (the “AI Act”), as amended, in relation to AI systems made available by Helpwan as part of the Services.

D1.2. This Annex supplements and does not reduce the obligations in the DPA. Where this Annex and the DPA conflict on a matter of personal data protection, the DPA prevails.

D2. Definitions

D2.1. AI System, Provider, Deployer, High-Risk AI System, Intended Purpose, Substantial Modification, and General-Purpose AI Model have the meanings given in the AI Act.

D2.2. Helpwan AI Components means the AI Systems and AI-enabled functions supplied by Helpwan as part of the Services, including skills inference, matching, recommendation, and scoring functions.

D3. Roles

D3.1. Helpwan acts as Provider of the Helpwan AI Components. Customer acts as Deployer in respect of its use of them.

D3.2. The parties acknowledge that AI Systems used for recruitment or selection, for decisions affecting terms of work, promotion, or termination, for task allocation, or for evaluating performance or behaviour of persons in a work-related relationship fall within point 4 of Annex III to the AI Act. Helpwan will treat the Helpwan AI Components as High-Risk AI Systems where and to the extent that classification applies.

D3.3. Under Regulation (EU) 2026/1744, the obligations applicable to standalone High-Risk AI Systems listed in Annex III apply from 2 December 2027. Helpwan’s commitments in Section D5 apply from that date, or from any earlier date on which those obligations become applicable to the Helpwan AI Components. Sections D4, D6, and D7 apply from the effective date of the Agreement.

D4. Obligations applying now

D4.1. AI literacy (Article 4). Each party will take measures to ensure a sufficient level of AI literacy among its staff and other persons operating the Helpwan AI Components on its behalf, taking into account their technical knowledge, experience, and the context of use. Helpwan will make available onboarding and/or reference material to support Customer in meeting this obligation.

D4.2. Transparency (Article 50). Where the Services include a function through which a natural person interacts directly with an AI System, Helpwan will ensure the person is informed of that fact unless it is obvious from the circumstances. Where the Services generate synthetic text, audio, image, or video content, Helpwan will mark that content in a machine-readable format and make it detectable as artificially generated to the extent required by Article 50(2).

D4.3. Prohibited practices (Article 5). Helpwan will not supply, and Customer will not use, the Helpwan AI Components for any practice prohibited under Article 5 of the AI Act, including emotion inference in the workplace outside the medical or safety exceptions, and social scoring.

D5. Helpwan provider commitments (from the applicable date)

D5.1. Where and to the extent the Helpwan AI Components are classified as High-Risk AI Systems, Helpwan will comply with the obligations applicable to it as Provider under the AI Act, and will make available the instructions for use and information Customer needs to meet its Deployer obligations.

D5.2. Helpwan will inform Customer without undue delay of any serious incident under Article 73 affecting the Helpwan AI Components used by Customer, and of any corrective action taken under Article 20.

D5.3. Helpwan will provide Customer with the information and documentation reasonably necessary for Customer to comply with its Deployer obligations, including the instructions for use and the information required for Customer to inform affected workers and their representatives.

D6. Customer deployer obligations

D6.1. Customer will use the Helpwan AI Components in accordance with the instructions for use provided by Helpwan.

D6.2. Customer will assign human oversight to natural persons who have the necessary competence, training, authority, and support to perform that role, including the authority to disregard, override, or reverse an output of the Helpwan AI Components.

D6.3. Where Customer controls input data, Customer will ensure the input data is relevant and sufficiently representative in view of the intended purpose of the Helpwan AI Components.

D6.4. Customer will monitor the operation of the Helpwan AI Components and inform Helpwan without undue delay where Customer has reason to consider that use in accordance with the instructions may present a risk within the meaning of Article 79(1), or where Customer identifies a serious incident.

D6.5. Customer will retain the logs generated by the Helpwan AI Components that are under Customer’s control for a period appropriate to the intended purpose and at least six months, unless a longer period is required by applicable law.

D6.6. Before putting the Helpwan AI Components into service or using them in the workplace, Customer will inform the workers concerned and their representatives that they will be subject to their use. Customer is responsible for any consultation, notification, or consent requirement arising under national employment law, collective agreements, or works council arrangements.

D6.7. Where a decision informed by the Helpwan AI Components produces legal effects or similarly significantly affects a natural person, Customer will inform that person of the use of the AI System and, on request, provide clear and meaningful explanations of the role of the AI System in the decision.

D7. Change of role under Article 25

D7.1. Customer acknowledges that under Article 25(1) of the AI Act it will be considered the Provider of a High-Risk AI System, and will assume the corresponding obligations, if it: (a) places its name or trade mark on the Helpwan AI Components, save as expressly permitted under the Agreement; (b) makes a Substantial Modification to them; or (c) modifies their intended purpose such that they become, or remain, a High-Risk AI System for a purpose other than that specified by Helpwan.

D7.2. Customer will notify Helpwan in writing before taking any action described in Section D7.1. Where Customer becomes a Provider under Article 25(1), Helpwan ceases to be the Provider in respect of that modified system, and Helpwan will provide the information and reasonable technical access necessary for Customer to fulfil its Provider obligations, subject to protection of Helpwan’s confidential information and intellectual property.

D7.3. Configuration of the Services within the parameters exposed by Helpwan, and use of tenant branding features made available by Helpwan, do not of themselves constitute a Substantial Modification or a change of intended purpose.

D8. General-purpose AI models and third-party components

D8.1. Where the Helpwan AI Components incorporate a General-Purpose AI Model supplied by a third party, that supplier is disclosed as a Subprocessor under Section 9.2 of the DPA where it processes Customer Personal Data.

D8.2. Helpwan will obtain from each such supplier the information and documentation necessary to meet Helpwan’s obligations under Article 25(4) and will not use a supplier that materially restricts Helpwan’s ability to comply with the AI Act.

D8.3. Consistent with Section 3.6 of the DPA, Customer Personal Data will not be used to train, fine-tune, or otherwise improve any General-Purpose AI Model or foundation model, whether Helpwan’s or a third party’s.

D9. Classification review and changes in law

D9.1. The parties acknowledge that the classification of the Helpwan AI Components, and the timetable for the AI Act’s application, may change as a result of amendments to the AI Act, harmonised standards, Commission guidance, or the exercise of delegated powers. Helpwan will review the classification at least annually and notify Customer of any material change.

D9.2. Nothing in this Annex constitutes an admission or determination that any Helpwan AI Component is or is not a High-Risk AI System for any purpose other than the allocation of responsibilities between the parties.

D10. Liability

D10.1. Each party’s liability under this Annex is subject to the exclusions and limits in the Agreement, to the maximum extent permitted by law. Nothing in this Annex limits or excludes liability that cannot be limited or excluded under the AI Act or other mandatory law.

Annex E — Optional signatures

Separate signatures are not required where the Agreement incorporates this DPA.

For Helpwan Corporation OÜ
Name: ____________________
Title: ____________________
Date: ____________________
Signature: ____________________

For Customer
Legal name: ____________________
Name: ____________________
Title: ____________________
Date: ____________________
Signature: ____________________