データ処理契約（DPA）

This Data Processing Agreement (the "DPA") governs the processing of personal data that Hexis, Inc. (株式会社Hexis) ("we", the processor) carries out on the instructions of a customer entity that subscribes to a workspace (the "Customer", the controller) when providing monet. This DPA forms part of the Terms of Service and is entered into when a workspace owner accepts it on this page (clickwrap). Where a separately signed data processing agreement exists, that agreement prevails as set out in Section 14.

• "Personal data" means information relating to an identified or identifiable individual.
• "Processing" means any operation performed on personal data, such as collection, recording, storage, use, disclosure, or erasure.
• "Controller" and "processor" have the meanings given under applicable data protection law.
• "Subprocessor" means a third party engaged by us to process personal data.

We process personal data solely to provide monet to the Customer. The data subjects include the Customer and its members, and the personal data contained in data that monet obtains through connected services (email, calendar, chat, etc.). The nature of processing is referencing, summarizing, generating, and acting on data by an AI agent, together with the associated storage and retrieval. As the controller, the Customer is responsible for the lawfulness of its processing instructions and for the legal basis for processing and any consents to be obtained from data subjects.

• Process personal data only on the Customer's documented instructions (including this DPA and the Terms).
• Impose confidentiality obligations on personnel involved in processing.
• Implement the technical and organizational security measures set out in Section 7.
• On the Customer's request, make available information reasonably necessary to demonstrate compliance with this DPA and applicable law.
• Inform the Customer if, in our opinion, an instruction infringes applicable data protection law.

The Customer generally authorizes us to engage subprocessors to provide monet. We impose data protection obligations on each subprocessor that are equivalent to those in this DPA. Current key subprocessors include our underlying infrastructure and model providers (cloud hosting, AI inference and generation providers), our observability and memory platform, and providers that record and transcribe online meetings or retrieve public information. We make the current list available on request. We will give prior notice of any addition or change of subprocessor by appropriate means (such as posting on our website). The Customer may object within 30 days of such notice on reasonable data-protection grounds; absent an objection within that period, the addition or change is deemed accepted.

Personal data is stored and processed in the cloud regions we designate. Where a cross-border transfer occurs, we put in place the appropriate safeguards required by applicable data protection law. For transfers from the European Economic Area, the United Kingdom, or Switzerland, the parties incorporate, to the extent required, the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA); those clauses prevail over this section to the extent of any conflict. Details on data location are described on our security page (/trust).

• Encryption in transit and at rest.
• Per-workspace data isolation and access controls.
• Encrypted storage of sensitive information such as credentials and integration tokens.
• Least-privilege access and audit logging.

Taking into account the nature of the processing, we reasonably assist the Customer, insofar as technically feasible, in responding to data subject rights requests (access, rectification, erasure, etc.).

If we become aware of a personal data breach affecting personal data we process, we will notify the Customer without undue delay and provide information reasonably necessary for the Customer to meet its legal obligations.

On termination of the Service, at the Customer's choice we will return or delete personal data, except where retention is required by applicable law. Deleting a workspace deletes the data associated with that workspace.

We will make available information reasonably necessary to demonstrate compliance with this DPA. Any audit by the Customer shall be conducted on reasonable prior notice, subject to confidentiality, and in a manner that minimizes disruption to our operations. Audits shall be limited to what is required under data protection law, at the Customer's expense, and to no more than once per year. We may satisfy this by providing a summary of an independent third-party audit report instead.

Our liability under this DPA is subject to the limitations and caps on liability set out in the Terms of Service. We are responsible for the acts of a subprocessor only to the same extent we would be responsible under this DPA had we performed those acts ourselves.

This DPA remains in effect for as long as the Customer uses monet. Our processing ends upon termination of the Customer's use of the Service and completion of the return or deletion of data under Section 10.

Where a separate, signed data processing agreement has been executed (e.g. with an enterprise Customer), the terms of that agreement prevail over this DPA. This clickwrap DPA is the standard set of terms that applies to workspaces without such a negotiated agreement.

• Processor: Hexis, Inc. (株式会社Hexis)
• Representative: Yuri Kurashima
• Address: MIEUX Shibuya Bldg. 8F, 5-3 Maruyamacho, Shibuya-ku, Tokyo, Japan
• Corporate number: 2011001175910
• Email: yuri.kurashima@hexis.ltd