> ## Documentation Index
> Fetch the complete documentation index at: https://docs.buildbetter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# International Data Processing Addendum

> DPA for Build Better, Inc.

> **📄 Read and download the entire DPA on our trust portal here:**\
> [https://trust.buildbetter.ai/resources?s=ib6b62opxkoo5zlshrwh8f\&name=international-bb-data-processing-agreement](https://trust.buildbetter.ai/resources?s=ib6b62opxkoo5zlshrwh8f\&name=international-bb-data-processing-agreement)

# International Data Processing Addendum

This Data Processing Addendum (“**DPA**”) supplements the Build Better, Inc. Master Subscription Agreement (the “**Agreement**”) between the customer signing this DPA (“**Customer**”) and Build Better, Inc. (“**Company**”). By executing this DPA, Customer enters into it on behalf of itself and, where applicable, its Affiliates.

Unless otherwise defined herein, capitalized terms shall have the meanings assigned in the Agreement.

## 1. Definitions

* **Affiliate**: An entity directly or indirectly controlling, controlled by, or under common control with a party.
* **Authorized Sub-Processor**: A third party authorized to process Customer Personal Data under the Agreement.
* **Company Account Data**: Personal data related to Customer’s account, including contacts and billing.
* **Company Usage Data**: Service usage data collected for performance and abuse prevention.
* **Data Exporter**: The Customer.
* **Data Importer**: The Company.
* **Data Protection Laws**: Includes GDPR, UK GDPR, CCPA, Swiss FADP, and other relevant regulations.
* **EU SCCs**: Standard Contractual Clauses adopted in EU Commission Decision 2021/914.
* **ex-EEA/UK Transfers**: Transfers of data outside the EEA or UK not covered by adequacy decisions.
* **Services**: Defined in the Agreement.
* **Standard Contractual Clauses (SCCs)**: Includes EU SCCs and UK SCCs.

## 2. Processing of Data

* Customer is a controller or processor; Company is the processor (unless otherwise specified).
* Customer must comply with all Data Protection Laws and ensure that instructions to Company are lawful.
* Processing details are in **Exhibit A**.
* Upon service termination, Company will return or delete data unless required to retain it.
* Under the CCPA, Company is a **service provider** and will not sell or misuse Customer data.

## 3. Confidentiality

Company personnel authorized to process data are bound by confidentiality obligations. Disclosures may be made to advisors or auditors when necessary.

## 4. Sub-Processors

* Company may engage Authorized Sub-Processors (listed at [https://sites.buildbetter.ai/subprocessors](https://sites.buildbetter.ai/subprocessors)).
* Customer can object within 10 days of notice. Essential sub-processors may be required for services.
* Sub-processors are contractually obligated to maintain data protection standards.

## 5. Security Measures

See **Exhibit C** for technical and organizational measures including:

* Encryption (in transit and at rest)
* Access controls
* Security audits (SOC 2 Type II)
* Incident response and logging

## 6. Data Transfers

* Company primarily processes data in the U.S.
* Ex-EEA, ex-UK, and Swiss transfers are governed by SCCs, described in Section 6 and detailed in **Exhibits B–D**.
* Supplementary measures apply, including notice of government access requests.

## 7. Rights of Data Subjects

* Company will notify Customer of Data Subject Requests.
* Customer is responsible for fulfilling those requests.
* Company will assist, where necessary, with appropriate technical and organizational support.

## 8. Audits & Requests

* Customer may audit or review certifications or perform on-site audits annually.
* Requests must be reasonable and non-disruptive.
* Company will assist with DPIAs and supervisory authority interactions.

## 9. Personal Data Breach

* Company shall notify Customer without undue delay upon becoming aware of a Personal Data Breach.
* Cooperation will be provided for regulatory notifications and remediation.

## 10. Company as a Controller

Company acts as an independent controller for **Company Account Data** and **Usage Data** for:

* Relationship management
* Fraud detection
* Legal compliance

See [Privacy Policy](https://sites.buildbetter.ai/privacy).

## 11. Conflict Resolution

In case of conflict:

1. SCCs prevail
2. This DPA
3. The Agreement
4. Privacy Policy

## 12. Execution

Company has pre-signed this DPA. Customer must:

1. Complete and sign the signature block
2. Fill in **Exhibit B**
3. Email the signed copy to [legal@buildbetter.ai](mailto:legal@buildbetter.ai)

***

## Exhibit A – Processing Details

* **Purpose**: To deliver the Services under the Agreement.
* **Processing Activities**: Collection, encryption, analysis, deletion, sharing.
* **Duration**: As needed per the Agreement, business purposes, or law.
* **Data Subjects**: Employees, contractors, agents.
* **Personal Data Types**: Names, emails, job titles, device data, training records.
* **Sensitive Data**: Prohibited.

***

## Exhibit B – Transfer Details (SCC Annex I)

* **Data Exporter**: The Customer
* **Data Importer**: Build Better, Inc.
* **Data Categories**: As defined in Exhibit A
* **Supervisory Authority**: Based on Data Exporter’s jurisdiction

***

## Exhibit C – Security Measures (SCC Annex II)

Includes encryption, access control, breach response, system logging, audit practices, and sub-processor contracts. Measures align with SOC 2 Type II and AWS best practices.

***

## Exhibit D – UK Addendum (UK SCCs)

* **Tables 1–4**: Incorporates EU SCCs as modified for UK GDPR
* **Interpretation**: UK law prevails in UK Addendum
* **Revisions**: Handled via ICO-approved mechanisms
* **Disputes**: Resolved under UK courts

***

> **📄 Read and download the entire DPA on our trust portal here:**\
> [https://trust.buildbetter.ai/resources?s=ib6b62opxkoo5zlshrwh8f\&name=international-bb-data-processing-agreement](https://trust.buildbetter.ai/resources?s=ib6b62opxkoo5zlshrwh8f\&name=international-bb-data-processing-agreement)