Data Processing & AI Addendum

Part 1: Data Processing Addendum (DPA)

In consideration of the mutual obligations set out herein, Internet4associations and Client, collectively ("the Parties") hereby agree that the terms and conditions set forth below shall be added as an addendum to the Master Services Agreement to govern processing by Internet4associations of any EU Personal Data that is subject to the European Union ("EU") General Data Protection Regulation 2016/679 ("GDPR") and similar laws, which require certain data protection and privacy obligations to be covered contractually.

To the extent that any terms or conditions set forth in any other agreement between the Parties, including agreements entered into after the date of this DPA, conflict with any terms or conditions of this DPA, it is expressly understood and agreed that the terms and conditions set forth in this DPA will apply rather than the conflicting terms and conditions in any other written agreement, unless the Parties explicitly agree otherwise in writing. The Parties will not agree, under any circumstance, to providing less protection to EU Personal Data than is required by all applicable laws, regulations, directives, rules, standards, and frameworks.

Effective Period: This DPA will be effective beginning May 25, 2018, and will remain effective for as long as Internet4associations and any Sub-Processor to which Internet4associations has disclosed any EU Personal Data retains any EU Personal Data received from Client.

Definitions

For purposes of this DPA, the following terms will have the following meanings:

• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• Client: The legal entity or individual who accepted Internet4Associations' Master Services Agreement, which includes this DPA.
• Data Protection Impact Assessment ("DPIA"): A process designed to describe the Processing, to assess the necessity and proportionality of the Processing, and to help manage the risks to the rights and freedoms of natural persons resulting from the Processing of Personal Data.
• Data Subject: An identified or identifiable natural person whose Personal Data is being Processed.
• EU Personal Data: Any information relating to an identified or identifiable natural person located in the EU.
• Personal Data: Any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
• Processing: Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• Processor: A natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.
• Sub-Processor: A Sub-Processor retained by a Processor to assist with Processing activities.

Any Capitalized, data protection terms used in this DPA, which are not specifically defined in this DPA, will have the meaning ascribed to them in the GDPR.

EU Personal Data Protection Compliance

The Parties' General Compliance Obligations: In connection with the Services covered by the Master Services Agreement and this DPA, Internet4associations and Client will comply with all applicable provisions of the GDPR on and after May 25, 2018, as well as all applicable Member State laws and regulations.

Details of Processing: Pursuant to Article 28 of the GDPR, the details of the processing covered by the Master Services Agreement and this DPA are set forth in the Appendix ("Appendix: Details of Processing") attached to this DPA.

Client Obligations and Authorization of Processing

The Parties agree that Client is the Controller, and Internet4associations is the Processor. Client is and shall remain responsible for compliance with all requirements imposed on Controllers, including but not limited to confirming the lawful basis for all processing activities conducted by Internet4associations on Client's behalf and obtaining consent from data subjects, where required.

Client authorizes Internet4associations to collect and process the EU Personal Data needed to perform the Services for which Client is contracting with Internet4associations in the Master Services Agreement. Client agrees to limit any EU Personal Data it transfers to Internet4associations or to which Internet4associations is otherwise given access for processing to only EU Personal Data needed by Internet4associations to fulfill its obligations under the Master Services Agreement.

Client authorizes the transfer, processing and storage of EU Personal Data outside the European Economic Area (EEA) in order to fulfill the purpose of the Services.

Client grants a general authorization to Internet4associations to engage or replace Sub-Processors to perform part of the Service, provided that Internet4associations respects all requirements set forth in the GDPR for the appointment of Sub-Processors. Client hereby consents to Internet4Associations' engagement of Sub-Processors in connection with the processing of the Personal Data.

Upon written request, Internet4associations will make the list of applicable Sub-Processors available to Client. Client may reasonably object to any new Sub-Processor, in which case Internet4associations will use reasonable efforts to make a change in the Service or recommend a commercially reasonable change to avoid processing by such Sub-Processor. If Internet4associations is unable to provide an alternative, Client may terminate the affected Services.

Internet4associations will enter into written agreements with each Sub-Processor containing reasonable provisions relating to the implementation of technical and organizational measures in compliance with the GDPR. Internet4associations will remain liable for acts and omissions of its Sub-Processors in connection with the provision of the Services.

Internet4Associations' EU Personal Data Protection Obligations

• Internet4Associations' Processing of EU Personal Data on Client's behalf will be conducted in accordance with documented instructions received from Client. Internet4associations will promptly inform Client if, in Internet4Associations' opinion, an instruction from Client infringes on the GDPR or other Member State data protection provisions.
• Internet4associations will only provide access rights to EU Personal Data to associates who have committed themselves to confidentiality.
• Internet4associations has implemented appropriate technical and organizational measures in accordance with Article 32 of the GDPR.
• Internet4associations will abide by the requirements set forth in the GDPR for the appointment of Sub-Processors.
• Internet4associations has implemented measures to assist Client in responding to data subject requests to exercise their data subject rights.
• After becoming aware of any Personal Data Breach involving EU Personal Data received from Client or collected on Client's behalf, Internet4associations will notify Client without undue delay.
• Internet4associations will assist Client in complying with its GDPR obligations relating to the Services concerning the security of processing, notification of an EU Personal Data Breach, Data Protection Impact Assessments (DPIAs), and prior consultations.
• Depending on Client's asserted choice, Internet4associations will either delete or return all EU Personal Data to Client after the end of the provision of Services unless EU or Member State law requires storage of the EU Personal Data.
• Upon written request, Internet4associations will provide Client with information needed to demonstrate compliance with the obligations of Article 28 of the GDPR, and will permit and contribute to audits, including inspections, conducted by Client or another auditor mandated by Client.

Right to Terminate Agreement

In the event of any breach of this DPA by Client, Internet4associations has the right to terminate the Services and Agreement without penalty to Internet4associations upon written notice to Client.

Indemnification

Client will fully indemnify, hold harmless and defend Internet4associations, its affiliates, and their respective officers, directors, employees, agents and contractors (collectively, "Indemnified Parties") from and against any and all claims, demands, actions, suits, damages, liabilities, losses, settlements, judgments, regulatory investigations, enforcement actions, administrative penalties, fees, fines, costs, and expenses (including but not limited to reasonable attorney's fees and costs) (each a "Claim") any of them suffer as a result of:

• A breach by Client or its employees, representatives, agents, or contractors of any of Client's obligations set forth in this DPA
• A Personal Data Breach caused by any act, omission or negligence of Client or its employees, representatives, agents, or contractors
• Client's, or its employees', representatives', agents', or contractors' violation or breach of the GDPR or any other applicable data protection or privacy law, regulation, directive, rule, standard, or framework, including but not limited to violation or breach of the rights of a data subject and violations relating to Client's use of Internet4Associations' products and/or services

Internet4associations reserves the right to assume the exclusive defense and control of any matter subject to indemnification at the expense of Client, and in such case, Client agrees to cooperate with Internet4associations in the defense of any such Claim.

Severability

If any provision of this DPA is, to any extent, invalid or unenforceable, all other provisions of the DPA will remain in full force and effect. To the extent permitted and possible, the invalid or unenforceable provision will be deemed replaced by a term that is valid and enforceable and that comes closest to expressing the intention of such invalid or unenforceable term. If this is not permissible or not possible, then the DPA will be construed as if the invalid or unenforceable provision were not included in the DPA.

No Limitation on Internet4Associations' Rights or Remedies

Nothing in this DPA will limit Internet4Associations' rights or remedies under the Agreement or at law.

Governing Laws/Jurisdiction

The Parties to this DPA submit to the choice of jurisdiction set forth in the Master Services Agreement with respect to any disputes or claims arising under this DPA. The Parties further stipulate that any and all disputes concerning the construction and interpretation of this DPA and/or the Parties' obligations under this DPA will be handled in accordance with pertinent provisions governing disputes or claims that are set forth in the Master Services Agreement.

Appendix: Details of Processing

Subject Matter and Duration of Processing

The subject matter and duration of the Processing of EU Personal Data are set forth in the Agreement and this DPA.

Nature and Purpose of Processing

• Membership management
• Event registration
• Online payments
• Email and contact database
• Content Manager
• Mobile solutions

Categories of Data Subjects

• Clients
• Clients' members
• Clients' contacts

Categories of Personal Data

• Contact information (e.g., name, organization name, phone number, email address)
• Payment information (e.g., billing address, billing contact)

---

Part 2: AI-Powered Features Addendum

Client Access Only

AI features are only available to authorized users who have licensed the i4a platform. These features are not available for use by the general public or by members or constituents of client organizations. By using these tools, the client confirms that access is limited to approved administrative personnel acting on behalf of their organization.

By using these AI features, you agree to the following terms and provide your explicit consent as outlined in the AI Consent Policy section below.

1. Overview of AI-Powered Tools (ImageCraft, TextCraft, DataAnalyze)

i4a offers AI-powered tools through integration with OpenAI's services. These tools are provided to assist users in creating content, analyzing data, and generating images or other outputs. All AI-generated content is produced by OpenAI and is subject to its own terms:

• OpenAI Terms of Use
• OpenAI Privacy Policy

The i4a platform includes the following AI-powered tools:

• ImageCraft – for generating, editing, and modifying images using natural language prompts or existing images.
• TextCraft – for generating, rewriting, or transforming written content (e.g., blog posts, pages, email copy), including tone changes and summarization.
• DataAnalyze – for uploading and analyzing exported data from the i4a platform, including visualizations, trend identification, summaries, outlier detection, totals, and metrics.

2. No Guarantee of Accuracy or Appropriateness

AI-generated outputs may:

• Contain factual errors
• Misinterpret data
• Reflect bias or inappropriate tone
• Produce unexpected or unsuitable content

i4a does not guarantee the accuracy, completeness, legality, or usefulness of any AI-generated output and is not responsible for errors or misuse. You must review all generated content carefully before using or publishing it.

3. Acceptable Use

You agree not to use AI features to generate or disseminate content that:

• Violates any law or regulation
• Is false, misleading, or defamatory
• Is discriminatory, abusive, or harmful
• Infringes on the rights of others, including intellectual property
• Contains or involves sensitive personal data (e.g., health records, financial data, government-issued identifiers)
• Violates any terms of your Master Services Agreement

i4a reserves the right to disable access to AI features for any user found to be in violation of these conditions.

4. Data Use and Privacy

i4a collects and processes limited data as part of providing AI-powered features. The following terms apply to your use of these features:

• Session Data: i4a stores both the AI prompt and the corresponding response during your session. This information may be retained temporarily to support functionality, troubleshooting, and support requests.
• Internal Access: This data may be accessed by authorized i4a staff and system administrators for diagnostic and operational purposes.
• Voice Transcription: When using voice features, your voice is temporarily captured and sent to OpenAI's API for transcription. i4a does not store any recordings. Once transcription is complete, the audio file is discarded, and only the transcribed text is retained in the session. Handling of voice data by OpenAI is governed by their Privacy Policy and API service terms.
• DataAnalyze Uploads: When using DataAnalyze, you may upload exported files (e.g., CSVs) for AI-driven analysis. i4a does not access or review the content of these files. You are responsible for ensuring that uploaded data is appropriate and authorized for processing by OpenAI.
• Third-Party Processing: All inputs (text prompts, transcribed voice, and uploaded files) are sent to OpenAI for processing and may be stored according to OpenAI's Privacy Policy.
• Training and Resale: i4a does not use your prompts or responses for marketing, training, or resale. Additionally, OpenAI does not use your data for training when accessed via i4a's API-based integration under their Enterprise Terms.

User Responsibility

• Do not submit sensitive personal information, confidential organizational data, or anything protected under applicable regulations (e.g., HIPAA, FERPA) unless explicitly authorized to do so.
• Use of AI features constitutes acknowledgment and acceptance of OpenAI's data handling policies.

5. Intellectual Property

• You retain ownership of your original input content.
• You are granted rights to use the AI-generated outputs, subject to applicable laws and OpenAI's terms.
• It is your responsibility to ensure your use of AI-generated content complies with copyright, licensing, and attribution rules.

5A. Fees and Licensing

Use of AI features is subject to:

• A separate i4AI license fee, and
• Usage-based charges determined by volume or frequency of use.

Each license applies only to the specific i4a platform instance or website for which it was purchased. Licenses are not transferable or shareable across multiple websites, domains, or installations. Clients with more than one site must obtain a separate license for each site where AI features will be enabled.

Details of pricing and billing will be communicated separately as part of your i4a service agreement. i4a reserves the right to modify pricing, service tiers, or feature availability at any time, with reasonable notice.

6. Service Availability

AI features rely on OpenAI's external services. i4a does not guarantee uninterrupted access or performance.

You may experience delays, outages, or degraded service outside of i4a's control.

For updates and availability, visit the OpenAI Status Page.

7. Limitation of Liability and Indemnification

AI features are provided "as is" and "as available." i4a makes no warranties, express or implied, regarding:

• The accuracy, completeness, or usefulness of AI-generated content
• Suitability of AI outputs for any specific purpose
• The absence of bias, infringement, or other legal risk in generated content

To the maximum extent permitted by law, you agree to hold i4a harmless and to indemnify i4a, its affiliates, employees, officers, and agents from and against any and all claims, damages, losses, liabilities, costs, or expenses (including reasonable attorney's fees) arising from:

• Your use of or reliance on AI-generated content
• Any content you generate or disseminate using the AI features
• Your violation of this AI Terms of Service or any applicable law or third-party rights

You assume full responsibility for how AI-generated outputs are used, published, stored, or interpreted within your organization or by your end users.

8. AI Consent Policy

As part of using the AI features in this system, you acknowledge and consent to the following:

a. Acknowledgment of AI Origin

You understand that all generated content (text, images, or data analysis) is produced by OpenAI, not i4a.

b. User Responsibility

• Reviewing and verifying the content before use
• Ensuring all AI outputs are appropriate for your audience and context
• Ensuring compliance with legal and policy requirements

c. Content Use

You retain ownership of your inputs. Use of outputs is permitted, but must not violate laws or third-party rights.

d. Data Handling

You agree not to submit:

• Sensitive personal information
• Proprietary or confidential organizational data

unless you are authorized and aware of the implications.

e. Acceptance

By using any AI-powered feature available to licensed clients, you:

• Understand that content is generated by an external AI system
• Accept all risks related to the accuracy or appropriateness of results
• Agree to use the tools in accordance with this Terms of Service

By using the AI features, you also agree to OpenAI's Terms of Use and Privacy Policy.

If you do not agree to these terms, you must not use the AI features.

9. Updates to This Policy

i4a reserves the right to modify these terms at any time. Continued use of AI features after changes are posted constitutes your acceptance of the updated policy.

---

Contact Us

If you have questions about this Data Processing & AI Addendum, please contact us: