Data Processing Addendum (DPA)

This DPA applies wherever and to the extent that Fusion processes Customer Personal Data on behalf of Customer in the course of providing the Fusion AI Gateway, API routing, and related infrastructure under the Terms of Service.

By agreeing to the Terms of Service or sending API requests containing Personal Data to Fusion endpoints, this DPA becomes an incorporated, binding part of the agreement between Customer and Fusion.

• "Applicable Data Protection Law" means all worldwide privacy laws applicable to the processing of Personal Data under the Agreement, including the EU GDPR, UK GDPR, Swiss Federal Data Protection Act, and US State privacy laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA).
• "Customer Personal Data" means any Personal Data submitted by or on behalf of Customer as Inputs into the Fusion AI Gateway.
• "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" have the meanings set forth in the GDPR.
• "Subprocessor" means any third party engaged by Fusion to process Customer Personal Data.

The parties acknowledge and agree that with respect to Customer Personal Data:

• Customer is the Controller (or a Processor acting on behalf of a third-party Controller); and
• Fusion is the Processor (or Sub-processor).

Documented Instructions: Fusion shall process Customer Personal Data solely in accordance with Customer's documented instructions, including with respect to international transfers, unless required to do so by applicable law. The Agreement, this DPA, and Customer's API configurations constitute Customer's complete instructions.

Zero Model Training: Fusion shall never process Customer Personal Data for the purpose of training, fine-tuning, or improving public machine learning foundation models.

Fusion ensures that any personnel authorized to process Customer Personal Data are bound by strict statutory or contractual confidentiality obligations and receive regular training on data protection and security standards.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, Fusion implements and maintains appropriate technical and organizational measures (detailed in Annex II) designed to ensure a level of security appropriate to the risk.

Key measures include TLS 1.3 transit encryption, ephemeral RAM-only stream proxying, multi-factor authentication, perimeter rate limiting, and automated denial-of-service mitigations.

Customer grants general authorization to Fusion to engage Subprocessors to assist in delivering the Services. Current Subprocessors are listed on our Subprocessors Registry.

• Subprocessor Obligations: Fusion imposes data protection terms on each Subprocessor that provide at least the same level of protection as this DPA.
• Notification of Changes: Fusion will provide written notice of any intended appointment of a new Subprocessor at least fourteen (14) days in advance via updates to the Subprocessors Registry or email alert. Customer may object on reasonable data protection grounds within ten (10) days.

To the extent Customer cannot directly access or fulfill a Data Subject request through the developer console, Fusion shall provide reasonable commercial assistance to help Customer satisfy its obligations to respond to requests under Applicable Data Protection Law.

Note: Because Fusion operates on a Zero Data Retention basis for inference payloads, Fusion does not retain prompt or completion histories on persistent databases.

In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Fusion shall notify Customer without undue delay and, in any event, within seventy-two (72) hours of becoming aware of the breach.

The notification will describe the nature of the incident, the categories and approximate number of Data Subjects affected, the likely consequences, and remedial measures taken or planned.

Fusion makes available to Customer all information reasonably necessary to demonstrate compliance with this DPA and allows for audits or inspections conducted by Customer or an independent auditor, subject to reasonable advance notice and non-disclosure agreements.

Upon termination of the Services, Fusion shall, at Customer's choice, delete or return all Customer Personal Data in its possession or control, unless applicable law requires continued storage (e.g., statutory tax and billing records).

Where the transfer of Customer Personal Data from the EEA, UK, or Switzerland to third countries requires an adequacy mechanism, the parties agree to incorporate the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor or Module 3: Processor-to-Processor), which are deemed executed and incorporated herein by reference.

To the extent the California Consumer Privacy Act (CCPA/CPRA) applies, Fusion certifies that:

• It acts as a "Service Provider" with respect to Customer Personal Information;
• It will not "sell" or "share" Customer Personal Information;
• It will not retain, use, or disclose Customer Personal Information for any purpose other than the business purposes specified in the Agreement; and
• It complies with all applicable restrictions under Section 1798.140 of the California Civil Code.

In the event of any conflict between the terms of this DPA and the Terms of Service, the provisions of this DPA shall govern with respect to data protection obligations. This DPA remains in effect for as long as Fusion processes Customer Personal Data.