Data Processing Addendum

Version 1.0 · Effective 28 October 2026

This addendum forms part of the Terms of Service between the customer ("Controller") and PeraLabs Ltd, trading as Rysh AI ("Processor"). It applies where we process personal data on your behalf through the Service. Terms such as "personal data", "controller" and "processor" have their UK GDPR meaning.

1. Scope

• Subject matter: providing the Service.
• Duration: the term of your subscription, plus the export and deletion period in the Terms.
• Nature and purpose: hosting, storing, transmitting and generating responses to Your Content (for example chatbot conversations, orders, messages and meeting content) as you instruct.
• Data subjects: your employees and invited users, and your own customers and contacts.
• Types of personal data: contact details, messages and content, order details, voice and meeting audio where you use those features, and technical identifiers.

2. Our duties as processor

We will:

1. process personal data only on your documented instructions, which are these terms and your use of the Service, unless the law requires otherwise (we will tell you first unless the law forbids it);
2. make sure everyone who may access it is bound by confidentiality;
3. take appropriate technical and organisational security measures under UK GDPR Article 32;
4. help you respond to data subjects' requests, taking account of the nature of the processing;
5. help you meet your security, breach-notification, impact-assessment and consultation duties;
6. tell you without undue delay, and in any event within 48 hours, after we become aware of a personal-data breach affecting your data;
7. at your choice, delete or return the personal data at the end of the Service, and delete existing copies unless the law requires us to keep them, in line with the retention periods in the Privacy Policy; and
8. give you the information needed to show our compliance and allow audits as set out below.

3. Sub-processors

You give us general authorisation to use the sub-processors listed in section 6 of our Privacy Policy. We bind each by a written contract with data-protection terms no less protective than these, and we stay responsible for them. We will give at least 30 days' notice of a new sub-processor, by email to your account owner. If you object on reasonable data-protection grounds, we will work with you; if we cannot resolve it, you may cancel the affected Service and receive a pro-rata refund of prepaid fees for the unused period.

4. International transfers

We transfer personal data outside the UK only as described in the Privacy Policy, under UK adequacy regulations, the UK International Data Transfer Addendum or Agreement, or another lawful safeguard.

5. Audits

We will, on request, give you the information needed to show compliance with this addendum. You may audit us once a year, on 30 days' written notice, during business hours, without disrupting our work, and at your own cost, under confidentiality. We may satisfy an audit by providing a recent independent report or a completed security questionnaire where that covers the same ground.

6. Your duties

You confirm that you have a lawful basis to give us the personal data and that your instructions comply with data-protection law. You are responsible for telling your own data subjects what is required.

7. Liability and order of precedence

Clause 14 (Liability) of the Terms applies to this addendum. If this addendum conflicts with the Terms on data protection, this addendum prevails.