Data Processing Agreement

1. Parties

Controller: The customer entity that has agreed to the AAMOS Terms of Service ("Controller").

Processor: Landvex AB, Sweden (org.nr 559141-7042), acting as the EU-based data processor, and Landvex Inc, Houston TX (collectively "Processor").

This Data Processing Agreement ("DPA") supplements and is incorporated into the AAMOS Terms of Service. In the event of conflict, this DPA prevails with respect to data processing matters.

2. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller solely to provide the AAMOS API services as described in the Terms of Service. Processing continues for the duration of the Controller's account and ceases upon account termination, subject to retention obligations.

3. Nature of Processing

• Processing operations: Collection, storage, analysis, and deletion of personal data submitted via the AAMOS API
• Purpose: Providing AI analysis and inference services as requested by the Controller
• Categories of data subjects: As determined by the Controller (typically end users of the Controller's applications)
• Categories of personal data: As submitted by the Controller, which may include images, biometric data, identification documents, and behavioural data

4. Controller Obligations

The Controller is responsible for:

• Ensuring a lawful basis exists for all personal data submitted to the AAMOS API
• Providing appropriate notices to data subjects
• Complying with all applicable data protection laws
• Ensuring data is accurate and up to date

5. Processor Obligations

The Processor will:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (Article 32 GDPR)
• Assist the Controller in responding to data subject rights requests
• Delete or return all personal data to the Controller upon termination of the agreement
• Provide all information necessary to demonstrate compliance with GDPR Article 28
• Notify the Controller without undue delay after becoming aware of a personal data breach

6. Sub-Processors

The Processor uses the following sub-processors. The Controller provides general authorisation for the use of sub-processors subject to notification of changes.

Sub-Processor	Purpose	Location
Amazon Web Services	Cloud infrastructure and storage	EU (Frankfurt, Ireland)
Stripe	Payment processing	United States / EU
Postmark	Transactional email	United States

The Processor will notify the Controller of any intended changes to sub-processors at least 14 days before the change takes effect, providing the Controller with an opportunity to object.

7. Data Residency

Personal data submitted by EU-based Controllers is processed and stored within the European Union by default (AWS Frankfurt and Ireland regions). Data is not transferred outside the EEA without appropriate safeguards.

8. International Transfers

Where personal data is transferred to the United States (Landvex Inc) or other third countries, such transfers are made pursuant to Standard Contractual Clauses (SCCs) as adopted by the European Commission in Decision 2021/914. A copy of the applicable SCCs is available on request from legal@landvex.com.

9. Security Measures

The Processor maintains the following technical and organisational measures:

• Encryption in transit: TLS 1.3 for all API communications
• Encryption at rest: AES-256 for stored data
• Access control: Role-based access, multi-factor authentication for staff
• Audit logging: All data access events logged and retained for 1 year
• Penetration testing: Annual third-party assessment
• Incident response: Documented procedure with 72-hour GDPR breach notification capability

10. Contact

DPA enquiries and rights assistance: legal@landvex.com