Abara Author will process Customer Personal Data only on documented instructions from Customer, including as necessary to provide, secure, support and maintain the Services, to provide customer-requested AI functionality, and as otherwise stated in the Agreement, unless applicable law requires other processing. Customer’s use and configuration of the Services, support requests and other documented directions consistent with the Agreement constitute Customer’s instructions.

Abara Author will inform Customer if, in Abara Author’s reasonable opinion, an instruction violates applicable Data Protection Law, unless prohibited by law.

Abara Author will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and receive appropriate data-protection and security guidance.

Abara Author will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. The current measures are summarized in Schedule 2. Abara Author may update its security measures provided the overall level of protection is not materially reduced.

Customer authorizes Abara Author to engage Subprocessors to process Customer Personal Data in connection with the Services. Abara Author will maintain a current list of Subprocessors at https://abaraauthor.ai/abara-author-subprocessors/ and will impose data-protection obligations on each Subprocessor that are materially consistent with these Data Processing Terms as applicable to the services performed.

Abara Author will provide at least thirty (30) days’ prior notice of a new Subprocessor that will process Customer Personal Data, for example through the Subprocessor page, an available subscription mechanism or other reasonable notice. Customer may object on reasonable data-protection grounds during that period. The parties will work in good faith to resolve a valid objection. If no commercially reasonable alternative is available, either party may terminate the affected Services without penalty, and Abara Author will refund prepaid fees for the unused affected period.

Abara Author remains responsible for the performance of its Subprocessors to the extent required by applicable Data Protection Law and subject to the liability provisions of the Agreement.

Taking into account the nature of the Processing, Abara Author will provide reasonable assistance to Customer, through appropriate technical and organizational measures where possible, to enable Customer to respond to requests by Consumers or Data Subjects exercising rights under applicable Data Protection Law.

If Abara Author receives such a request directly concerning Customer Personal Data, Abara Author will refer the requester to Customer or otherwise follow Customer’s documented instructions, unless applicable law requires Abara Author to respond directly.

Abara Author will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to Abara Author to assist Customer in meeting applicable notification obligations. Abara Author’s notification of a breach is not an admission of fault or liability.

Taking into account the nature of Processing and the information available to Abara Author, Abara Author will provide reasonable assistance with Customer’s obligations concerning security, breach notification, privacy assessments and other compliance obligations where required by applicable Data Protection Law.

Customer is responsible for ensuring that it has provided all notices and obtained all rights, consents, permissions and other authorizations required by applicable Data Protection Law for Abara Author to process Customer Personal Data in accordance with the Agreement and Customer’s instructions.

To the extent applicable U.S. Data Protection Law requires Abara Author to act as a Service Provider, Contractor or Processor, Abara Author will process Customer Personal Data only for the limited and specified purposes described in the Agreement and Customer’s documented instructions.

Except as permitted by applicable Data Protection Law and the Agreement, Abara Author will not:

• Sell Customer Personal Data or share Customer Personal Data for cross-context behavioral advertising;
• Retain, use or disclose Customer Personal Data outside the direct business relationship with Customer or for purposes other than providing the Services and performing obligations under the Agreement;
• Combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from Abara Author’s own interactions with an individual, except where Customer directs such combination or applicable Data Protection Law permits it; or
• Attempt to re-identify information that has been de-identified in accordance with applicable Data Protection Law, except where legally permitted.

Abara Author will notify Customer if it determines that it can no longer meet applicable obligations imposed on it as a Service Provider, Contractor or Processor. Upon reasonable notice from Customer that Abara Author’s Processing is not consistent with applicable Data Protection Law, the parties will work in good faith to address the issue. Customer may take reasonable and appropriate steps required by applicable law to help ensure that Customer Personal Data is processed consistently with these Data Processing Terms.

Following termination or expiration of the Services, Abara Author will delete Customer Personal Data in accordance with the Agreement and applicable retention practices, generally within thirty (30) days, unless Customer requests an earlier return or deletion where supported by the Services or applicable law requires retention. Personal Data retained pursuant to law will remain protected under these Data Processing Terms and will not be processed for other purposes except as legally required.

Customer Personal Data contained in backups may remain until overwritten or deleted through the ordinary backup cycle, subject to continued protection under these Data Processing Terms.

Abara Author will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms. Customer will first rely on available security documentation, certifications, independent assessments and other information made available by Abara Author where those materials reasonably address Customer’s compliance needs.

If such information is insufficient to satisfy a requirement imposed by applicable Data Protection Law, Customer may conduct one reasonable audit per year on reasonable prior written notice, during normal business hours, subject to appropriate confidentiality, security, scope and non-disruption requirements. Customer will bear its audit costs unless an audit identifies a material breach by Abara Author. Additional audits may be permitted where required by applicable law or following a material Personal Data Breach reasonably related to the subject of the audit.

The liability provisions in the Agreement apply to these Data Processing Terms except to the extent prohibited by applicable Data Protection Law.

If these Data Processing Terms conflict with the Agreement on a matter concerning the Processing of Customer Personal Data, these Data Processing Terms will prevail with respect to that matter. If the parties separately execute a Data Processing Agreement that applies to the same Processing, that signed Data Processing Agreement will control to the extent stated in it.