Legal

Data Processing Addendum

Processor obligations for customer personal data · Skip to DPA

Review candidate. These legal documents are not yet approved for publication. Target effective date: 2026-10-01.

Version 2 · Effective 2026-10-01 · Last updated 2026-09-12

Version 2.0 --- Effective 2026-10-01 · Last updated 2026-09-12

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between BOMSync, Inc. ("BOMSync", "Provider") and the customer entity that accepted it ("Customer"). It applies where BOMSync processes Personal Data on Customer's behalf in providing the Services.

By accepting the Agreement, Customer accepts this DPA. Customer may request a countersigned copy at privacy@bomsync.com.

1. Definitions

"Data Protection Laws" means all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and US State Privacy Laws.

"US State Privacy Laws" means the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the Texas Data Privacy and Security Act, and comparable comprehensive state privacy laws, as applicable.

"Personal Data" means personal data, personal information, or equivalent within Customer Data as defined in the Agreement, processed by BOMSync on Customer's behalf.

"Sub-processor" means a third party engaged by BOMSync to process Personal Data.

"EU SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0.

"Restricted Transfer" means a transfer of Personal Data subject to the transfer restrictions in Chapter V of the GDPR, the UK GDPR, or the FADP.

"Controller", "Processor", "Data Subject", "Personal Data Breach", "Supervisory Authority", "Business", "Service Provider", "Sell", and "Share" have the meanings given in the applicable Data Protection Laws.

2. Roles, scope, and precedence

2.1 Roles. For Personal Data within Customer Data, Customer is the Controller (or a Processor acting on a third-party controller's instructions) and BOMSync is the Processor (or Sub-processor, correspondingly). Where Customer acts as a Processor, Customer warrants that it has the controller's authority to enter into this DPA and to authorise BOMSync's processing and Sub-processors.

2.2 Where BOMSync is a Controller. BOMSync acts as an independent Controller for account registration, authentication, billing and tax determination, support, security monitoring, and its own communications. That processing is not governed by this DPA and is described in the Privacy Policy. Nothing in this DPA makes BOMSync a Controller of Personal Data within Customer Data.

2.3 Precedence. In the event of conflict, the order is: (i) the EU SCCs or UK Addendum, where they apply; (ii) this DPA; (iii) the Agreement. This DPA prevails over the Agreement as to the processing of Personal Data.

2.4 Term. This DPA applies for as long as BOMSync processes Personal Data on Customer's behalf, and survives termination of the Agreement until that processing ends.

2.5 Representatives. Where GDPR Article 27 or UK GDPR Article 27 requires BOMSync to appoint a representative, BOMSync will make the representative's current contact details available in the Privacy Policy §2 and, where applicable, Annex I.

3. Processing instructions

3.1 BOMSync will process Personal Data only on Customer's documented instructions, including as to Restricted Transfers, unless required otherwise by applicable law. The Agreement, this DPA, and Customer's configuration and use of the Services constitute Customer's complete documented instructions.

3.2 Where BOMSync is required by law to process otherwise, it will inform Customer before processing unless that law prohibits it on important grounds of public interest.

3.3 BOMSync will inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction until it is confirmed, withdrawn, or amended. BOMSync is not obliged to carry out a legal assessment of Customer's instructions.

3.4 BOMSync will not Sell or Share Personal Data, will not retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted by Data Protection Laws, and will not combine it with personal information received from another source except as permitted. See Section 16.

4. Customer obligations

4.1 Customer is responsible for the lawfulness of its instructions and of the Personal Data it submits, including having a valid legal basis, providing required transparency notices to Data Subjects, and obtaining any necessary consents.

4.2 Customer will not submit, and will not instruct BOMSync to process, special category data under Article 9 GDPR, criminal offence data under Article 10, government identification numbers, financial account numbers, health data, or children's data, unless the parties have agreed in writing in advance. The Services are not designed for such data.

4.3 Customer is responsible for configuring access controls, managing Authorized Users, and applying appropriate retention settings within the Services.

5. Confidentiality and personnel

5.1 BOMSync will ensure that persons authorised to process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidence, surviving the end of their engagement.

5.2 BOMSync will limit access to Personal Data to personnel who require it to perform the Agreement, will apply role-based access control and least privilege, will require multi-factor authentication for administrative access, and will revoke access promptly on role change or departure.

5.3 BOMSync will provide data protection and security awareness training to personnel with access to Personal Data, and will carry out background screening where lawful and appropriate to the role.

6. Security

6.1 BOMSync will implement and maintain the technical and organisational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, taking account of the state of the art, implementation costs, and the nature, scope, context, and purposes of processing.

6.2 BOMSync may update those measures provided it does not materially reduce the overall level of protection. Material changes will be reflected in an updated Annex II.

6.3 Customer has reviewed Annex II and agrees that, for Personal Data of the categories described in Annex I, those measures are appropriate. Customer is responsible for its own security within the Services, including credential hygiene and access administration.

7. Sub-processors

7.1 General authorisation. Customer gives BOMSync general written authorisation to engage Sub-processors. The current list is at Annex III and maintained at /legal/subprocessors, which is the authoritative version.

7.2 Notice and objection. BOMSync will give at least thirty (30) days' notice before a Sub-processor is added or replaced, by posting to that page and notifying Customer's administrative contact. Customer may subscribe to notifications at that page. Customer may object on reasonable data protection grounds within the notice period. The parties will discuss in good faith; if no resolution is reached, Customer may terminate the affected subscription on written notice and receive a pro-rata refund of prepaid, unused fees for the terminated portion.

7.3 Emergency replacement. Where a Sub-processor must be replaced urgently for security, legal, or continuity reasons, BOMSync may do so with shorter notice, and will inform Customer as soon as practicable. Customer's objection right under 7.2 continues to apply after the fact.

7.4 Flow-down and responsibility. BOMSync will impose on each Sub-processor, by written contract, data protection obligations appropriate to the processing and consistent with applicable Data Protection Laws. BOMSync remains responsible to Customer for its Sub-processors' performance to the extent required by applicable Data Protection Laws and the SCCs, subject to Section 15 and the limitations of liability in the Agreement except where those limitations cannot lawfully apply.

8. International transfers

8.1 Hosting locations. Default hosting regions are set out in Annex I.B and in Section 9.5 of the Terms of Service. Identity, authentication, and primary application databases are hosted in France Central (European Union).

8.2 EU SCCs --- incorporated. Where a Restricted Transfer of Personal Data subject to the GDPR occurs from Customer to BOMSync, the EU SCCs are incorporated into this DPA by reference and form part of it, as follows:

  • Module Two (Controller to Processor) applies where Customer is a Controller.
  • Module Three (Processor to Processor) applies where Customer is a Processor acting for a third-party controller.
  • Clause 7 (docking clause) --- included.
  • Clause 9(a) --- Option 2 (general written authorisation) applies, with a notice period of thirty (30) days as set out in Section 7.2.
  • Clause 11(a) optional independent dispute resolution language --- not included.
  • Clause 13 --- the competent Supervisory Authority is identified in Annex I.C.
  • Clause 17 --- Option 1: the EU SCCs are governed by the law of France.
  • Clause 18(b): disputes under the EU SCCs will be resolved before the courts of France.
  • Annex I to the EU SCCs is Annex I to this DPA; Annex II to the EU SCCs is Annex II to this DPA; the list of Sub-processors for Clause 9 is Annex III to this DPA.

8.3 UK Addendum --- incorporated. Where a Restricted Transfer subject to the UK GDPR occurs, the UK Addendum is incorporated and completed as set out in Annex IV. The EU SCCs as amended by the UK Addendum govern that transfer. Neither party may end the UK Addendum under its Section 19 as against the other.

8.4 Switzerland. Where a Restricted Transfer subject to the FADP occurs, the EU SCCs apply with the following amendments: references to the GDPR are to the FADP; the competent authority is the Federal Data Protection and Information Commissioner; the term "Member State" does not prevent Data Subjects in Switzerland from bringing proceedings in Switzerland; and the EU SCCs also protect the data of legal entities until the FADP ceases to extend such protection.

8.5 Alternative mechanisms. If an adequacy decision or other lawful transfer mechanism becomes available and BOMSync elects to rely on it, BOMSync will notify Customer, and that mechanism will apply in place of the EU SCCs or UK Addendum to the extent it lawfully covers the transfer.

8.6 Onward transfers. BOMSync will ensure that any onward transfer to a Sub-processor outside the EEA, UK, or Switzerland is covered by an appropriate transfer mechanism.

9. Government and law enforcement access

9.1 If BOMSync receives a legally binding request from a public authority for disclosure of Personal Data, BOMSync will, to the extent permitted by law:

  • (a) notify Customer promptly, and where notice is prohibited, seek a waiver and challenge the prohibition, documenting its efforts;
  • (b) redirect the authority to Customer where possible;
  • (c) challenge the request where there are reasonable grounds to consider it unlawful, overbroad, or in conflict with the law of the jurisdiction where the data is held, including by seeking interim measures;
  • (d) disclose only the minimum amount of data reasonably necessary; and
  • (e) maintain records and publish aggregate statistics at least annually.

9.2 BOMSync has assessed the laws and practices of the destination countries relevant to transfers under Section 8 and considers that they do not prevent it from meeting its obligations under the EU SCCs. BOMSync will re-assess if circumstances change and will notify Customer if it can no longer comply.

9.3 BOMSync has not received any order requiring it to give a public authority direct or unrestricted access to Personal Data, and has implemented no back door or undisclosed access mechanism.

10. Data subject requests

10.1 Taking into account the nature of processing, BOMSync will assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to Data Subject requests under Chapter III GDPR and equivalent laws. The Services provide access, export, correction, and deletion functionality that Customer can operate directly.

10.2 If BOMSync receives a request directly from a Data Subject relating to Customer's Personal Data, BOMSync will not respond substantively, will advise the Data Subject to contact Customer, and will inform Customer promptly where it can identify the relevant Customer.

10.3 Where Customer cannot fulfil a request through the Services, BOMSync will provide reasonable assistance at Customer's cost where the assistance requires material engineering effort.

11. Assistance with DPIAs and consultation

Taking into account the nature of processing and the information available to it, BOMSync will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36 GDPR. Documentation available to support this includes Annex II, the Security Overview, and BOMSync's responses to standard security questionnaires.

12. Personal Data Breach

12.1 BOMSync will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

12.2 The notification will include, to the extent known and as it becomes available: the nature of the breach, the categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed, and a contact point. Where information is not available at the time, BOMSync will provide it in phases without undue delay.

12.3 BOMSync will take reasonable steps to contain, investigate, and remediate the breach, and will cooperate with Customer's own notification obligations to Supervisory Authorities and Data Subjects.

12.4 BOMSync's notification is not an acknowledgement of fault or liability.

12.5 Security incidents that do not result in unauthorised access to or disclosure of Personal Data --- such as unsuccessful access attempts, pings, port scans, or denial-of-service attempts that do not compromise data --- are not Personal Data Breaches and are handled through routine security operations.

13. Return and deletion

13.1 Export window. Customer may export Personal Data at any time during the term using the Services' export functions and export-ready APIs. Following expiry or termination, BOMSync will retain Personal Data in a retrievable state for thirty (30) days (the "Export Window"). During the Export Window, Authorized Users receive read-only export access as described in Section 9.6 of the Terms — sufficient to export Personal Data, but not to continue routine operational use of the Services.

13.2 Export formats. Personal Data exports use the same permitted methods as Customer Data in Section 9.6(c) of the Terms: tabular CSV or Excel with human-readable references, organized file downloads for collateral stored in blob storage, and read-only calls to export-ready API operations BOMSync publishes for the Customer's plan. BOMSync does not provide raw database dumps or schema exports as part of standard export.

13.3 Deletion. After the Export Window, BOMSync will delete Personal Data from production systems within thirty (30) days, and from backups in accordance with its backup rotation cycle, currently no more than 90 days. Personal Data in backups remains subject to this DPA until deleted.

13.4 Certification. On written request made during the Export Window, BOMSync will provide written certification of deletion.

13.5 Retention required by law. BOMSync may retain Personal Data where required by applicable law, in which case it will retain only what is necessary, for the period required, and will continue to protect it under this DPA.

13.6 Assisted export. Complex Personal Data exports beyond self-service tools may be ordered as professional services under a separate agreement, on the terms described in the Data Export & Departure Policy.

14. Audit and information rights

14.1 Information first. BOMSync will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including Annex II, the Security Overview, any third-party audit reports or certifications BOMSync holds, and completed security questionnaires.

14.2 Audits. Where the information in 14.1 is not sufficient, Customer or an independent auditor it mandates may conduct an audit, subject to: thirty (30) days' prior written notice; no more than once per twelve months, except following a Personal Data Breach affecting Customer or where required by a Supervisory Authority; conduct during business hours in a manner that does not unreasonably disrupt operations; and a written confidentiality undertaking from the auditor.

14.3 Limits. Audits will not extend to other customers' data, to BOMSync's commercially confidential information unrelated to this DPA, or to any third party's premises or systems. An auditor that is a competitor of BOMSync may be refused, in which case the parties will agree an alternative independent auditor.

14.4 Costs. Each party bears its own costs. Customer will reimburse BOMSync's reasonable costs for audits beyond the annual allowance, unless the audit reveals material non-compliance.

14.5 Sub-processors. BOMSync will use reasonable efforts to obtain equivalent information from Sub-processors, which will normally take the form of their published audit reports and certifications rather than on-site access.

15. Liability

15.1 Liability under this DPA is subject to the limitations and exclusions in the Agreement, including the aggregate contractual cap stated in the Agreement, except to the extent a limitation cannot lawfully apply.

15.2 Nothing in this DPA or the Agreement limits either party's liability to a Data Subject under Clause 12 of the EU SCCs, or any liability that cannot be limited under Data Protection Laws.

15.3 Where the EU SCCs apply, the liability provisions of the EU SCCs govern as between the parties in respect of claims by Data Subjects.

16. United States state privacy laws

16.1 Roles. Where US State Privacy Laws apply, Customer is the Business or Controller and BOMSync is the Service Provider or Processor.

16.2 BOMSync's undertakings. BOMSync:

  • (a) will not Sell or Share Personal Data, and receives no monetary or other valuable consideration for it;
  • (b) will not retain, use, or disclose Personal Data for any purpose other than performing the Services specified in the Agreement, or as otherwise permitted by US State Privacy Laws;
  • (c) will not retain, use, or disclose Personal Data outside the direct business relationship between the parties;
  • (d) will not combine Personal Data with personal information received from or on behalf of another person, or collected from its own interactions, except as permitted to perform a business purpose;
  • (e) will not use Personal Data for cross-context behavioural advertising or targeted advertising;
  • (f) will comply with the obligations applicable to it and provide the same level of privacy protection as required of Customer;
  • (g) will notify Customer promptly if it determines it can no longer meet its obligations, and on notice will cease processing or take reasonable steps to remediate; and
  • (h) will assist Customer in responding to consumer rights requests and, where required, in conducting data protection assessments.

16.3 Deidentified data. Where BOMSync processes deidentified data, it will take reasonable measures to prevent reidentification, will publicly commit to maintaining it in deidentified form, and will contractually obligate recipients to the same.

16.4 Customer's right to remediate. Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Data by BOMSync, which will normally be satisfied by the audit and information rights in Section 14.

17. Governing law and forum

17.1 This DPA is governed by the law specified in the Agreement, currently the State of Texas, except that the EU SCCs are governed by French law under Clause 17 Option 1, and the UK Addendum is governed by the laws of England and Wales.

17.2 Disputes arising under the EU SCCs are subject to the jurisdiction of the courts of France. Disputes arising under the UK Addendum are subject to the courts of England and Wales. All other disputes under this DPA follow the Agreement.

17.3 Nothing in this Section deprives a Data Subject of rights or remedies under Data Protection Laws, including the right to lodge a complaint with a Supervisory Authority or to bring proceedings in their place of habitual residence.

18. Notices

Notices under this DPA, including Sub-processor updates, will be sent to Customer's administrative contact and posted at /legal/dpa and /legal/subprocessors. Customer is responsible for keeping its administrative contact current and for subscribing to Sub-processor notifications.

Notices to BOMSync: privacy@bomsync.com, copy to BOMSync, Inc., 809 Paleface RR South, Spicewood, Texas 78669, USA, Attn: Privacy.

ANNEX I --- Description of processing and transfer

This Annex is Annex I to the EU SCCs.

I.A --- Parties

Data exporter: Customer, as identified in the Agreement. Role: Controller (Module Two) or Processor (Module Three). Contact: the administrative and privacy contacts on Customer's account. Activities: use of the BOMSync platform for construction and manufacturing information management, procurement, and project collaboration.

Data importer: BOMSync, Inc., 809 Paleface RR South, Spicewood, Texas 78669, United States. Role: Processor (Module Two) or Sub-processor (Module Three). Contact: privacy@bomsync.com Activities: provision of the BOMSync software-as-a-service platform.

EU representative: See the Privacy Policy §2; details will be published when appointment is required and completed. UK representative: See the Privacy Policy §2; details will be published when appointment is required and completed.

I.B --- Description of transfer

Categories of Data Subjects Customer's employees, officers, and administrators; Authorized Users; Customer's contractors, design consultants, subcontractors, and their personnel; supplier and manufacturer contacts; client and project stakeholder contacts; and other individuals whose data Customer or its Authorized Users submit to the Services.

Categories of Personal Data Name; business contact details including email, telephone, and business address; employer and job title; account identifiers and authentication data; role, permission, and seat assignment; primary business location of a licensed seat; project and task assignment; content of documents, models, bills of materials, submittals, transmittals, and correspondence submitted by Customer, which may contain personal data; audit trail and activity log entries; communications metadata; and IP address and device information.

Special category data None. Customer is contractually prohibited from submitting special category data under Section 4.2. If such data is submitted contrary to that prohibition, no additional restrictions beyond those in Annex II are applied, and Customer remains responsible.

Frequency of transfer Continuous, for the duration of the Agreement.

Nature and purpose of processing Hosting, storage, structuring, retrieval, transmission, display, backup, and deletion of Customer Data; authentication and access control; generation of outputs including quantities, bills of materials, classifications, and optimisation results, including through AI features; notification delivery; support; security monitoring and audit logging; and service operation and maintenance.

Hosting regions

Data category Region

Identity, authentication, and account records France Central (EU) Primary pooled application databases France Central (EU) Object and document storage France Central (EU) and East US Transactional email and message delivery (ACS) United States

A current list is maintained at /legal/regions.

Retention As set out in Section 13 and in Section 9.6 of the Terms of Service: a 30-day Export Window after termination, deletion from production within 30 days thereafter, and from backups within the backup rotation cycle.

Sub-processor transfers Subject matter, nature, and duration of processing by each Sub-processor are set out in Annex III.

I.C --- Competent Supervisory Authority

Where Customer is established in the EEA, the Supervisory Authority of Customer's place of establishment.

Where Customer is not established in the EEA but falls within the GDPR under Article 3(2) and has appointed an Article 27 representative, the Supervisory Authority of the Member State in which that representative is established.

Otherwise, the Commission Nationale de l'Informatique et des Libertés (CNIL), France, consistent with the choice of French law under Clause 17.

ANNEX II --- Technical and organisational measures

This Annex is Annex II to the EU SCCs. These measures are designed in alignment with ISO/IEC 27001 and the SOC 2 Trust Services Criteria. BOMSync does not currently hold a certification or completed attestation under either.

II.1 Pseudonymisation and encryption

  • Personal Data encrypted in transit using TLS 1.2 or higher, with modern cipher suites and HSTS enforced on public endpoints.
  • Personal Data encrypted at rest using AES-256 through Azure platform encryption for databases, object storage, and backups.
  • Cryptographic keys and supported Customer-provided AI/API credentials are managed in Azure Key Vault with access restricted through managed identities and role-based controls. Customer-provided AI/API credentials are not logged and are not displayed back in plaintext after storage. No production secrets are committed to source control.
  • Database-level encryption applied to identity and authentication stores.
  • Where technically feasible, identifiers are used in preference to directly identifying data in logs and telemetry.

II.2 Confidentiality

  • Role-based access control with least privilege, enforced at application and infrastructure layers.
  • Multi-factor authentication required for all administrative and production access.
  • Tenant isolation enforced at the data layer; queries scoped to the authenticated tenant.
  • Production access is limited to named personnel and granted for a defined purpose. Privileged access is logged where supported by the applicable Azure/application service. BOMSync will conduct documented privileged-access reviews periodically based on risk and at least annually following commercial launch.
  • Access revoked promptly on role change or departure.
  • Personnel with production access are subject to confidentiality obligations. Background screening will be used where lawful, appropriate to role, and implemented as BOMSync adds personnel with privileged production access.
  • Administrative access via managed identity rather than shared credentials.

II.3 Integrity

  • Production source code and configuration changes are maintained in version control and are subject to review appropriate to the change and team size before deployment.
  • Development and production are operationally separated. BOMSync policy prohibits copying production Personal Data into development, debugging, test, or AI-assisted engineering tools; synthetic or redacted data is used for those purposes.
  • Input validation and parameterised queries are used in production data-access paths where applicable.
  • BOMSync maintains security-relevant application and platform logs for authentication, authorization, administrative, and export activity to the extent supported by the applicable component. Logs are access-restricted and retained according to operational and security requirements.
  • Content hashing or equivalent integrity controls are used for stored documents where implemented by the applicable BOMSync workflow or Azure service.

II.4 Availability and resilience

  • Hosted on Microsoft Azure with platform-level redundancy.
  • Automated backups with point-in-time restore for primary databases; backups held within the same geography as the primary data.
  • Restore procedures are maintained and will be tested at least annually following commercial launch.
  • BOMSync uses Azure/application telemetry and operational monitoring appropriate to the deployed services and will expand automated alerting as commercial operations mature.
  • BOMSync is documenting business continuity and disaster-recovery procedures for commercial launch and will formally review them at least annually thereafter.

II.5 Testing and assessment

  • Repository secret scanning is automated. Dependency and vulnerability scanning will be enabled in the production build/release workflow and reviewed as part of commercial launch controls.
  • Static analysis is used where appropriate, and repository secret scanning is automated. BOMSync does not represent that every static-analysis rule executes on every commit.
  • Infrastructure and dependency vulnerabilities identified through Azure, repository, provider, or testing tools are triaged and remediated according to risk and severity.
  • BOMSync will complete its first independent penetration test within twelve (12) months after commercial launch and will perform independent penetration testing at least annually thereafter.
  • These measures and material Sub-processor security posture will be reviewed at least annually following commercial launch.

II.6 Identity and access management

  • Support for enterprise single sign-on via OpenID Connect and SAML.
  • Configurable password policy, session timeout, and account lockout.
  • Multi-factor authentication available to all customers and recommended for all users.
  • Customer-administered user provisioning and de-provisioning.
  • Authentication and identity records hosted in France Central.

II.7 Incident management

  • Security incident response procedures with defined escalation paths; BOMSync will formalize and document the commercial incident-response plan as part of launch operations.
  • Centralised logging with alerting on anomalous authentication and access patterns.
  • Customer notification without undue delay and, in any event, within 72 hours after becoming aware of a Personal Data Breach, per Section 12.
  • Post-incident review with documented remediation.
  • Vulnerability reports accepted at security@bomsync.com.

II.8 Sub-processor governance

  • Security and data protection assessment before engagement.
  • Written data protection terms no less protective than this DPA.
  • Transfer mechanisms in place for onward transfers outside the EEA and UK.
  • BOMSync-managed commercial AI providers are selected under business/API terms that do not permit use of Customer Data to train provider foundation models except where expressly disclosed and agreed.
  • Claude Data Quality is disabled by default and requires authorized tenant-administrator activation. BOMSync records the activation as a documented Customer instruction, including tenant, administrator, UTC timestamp, feature/version, and disclosure version.
  • Internal policy prohibiting Customer Data, production extracts, and personal data from being entered into any development, debugging, or AI-assisted engineering tool. Debugging uses synthetic or redacted data.
  • Available Sub-processor certifications, audit reports, and trust documentation are reviewed as appropriate to risk and at least during material provider onboarding or reassessment.

II.9 Data minimisation, deletion, and portability

  • Customer-configurable retention within the Services.
  • Self-service export through the user interface and documented APIs.
  • Deletion on the timetable in Section 13, with certification available on request.
  • Data residency options available by Order Form.

II.10 Physical security

Physical security of processing facilities is provided by Microsoft Azure under its own certifications, including ISO/IEC 27001 and SOC 2. BOMSync operates no data centres. BOMSync personnel access the Services only from managed endpoints with full-disk encryption, screen lock, and endpoint protection.

ANNEX III --- Sub-processors

This Annex is the list for Clause 9 of the EU SCCs. The authoritative current version is maintained at /legal/subprocessors.

Sub-processor Purpose Processing / data Contractual location transfer safeguard

Microsoft Core hosting, tenant AuthDB / identity: Microsoft Azure databases, France Central. Products and identity/authentication, Tenant databases and Services Data Azure Blob storage, Blob storage: Protection backups, logging, Key France Central or Addendum and Vault, and related East US, depending applicable infrastructure on tenant Microsoft provisioning. contractual transfer safeguards, including EU SCCs and the UK transfer mechanism where required.

Azure Transactional email and United States Microsoft Communication communications Products and Services Services Data (Microsoft) Protection Addendum and applicable Microsoft contractual transfer safeguards, including EU SCCs and the UK transfer mechanism where required.

Azure AI Azure AI Document Document Microsoft services Intelligence and Azure Intelligence Products and (Microsoft) OpenAI / Microsoft Foundry processes in the Services Data features used by BOMSync Azure region in which Protection the applicable Addendum and resource is created. applicable Azure OpenAI / Microsoft Foundry processing contractual depends on BOMSync's transfer configured deployment safeguards, type and resource including EU SCCs region. The exact and the UK BOMSync production transfer deployment(s) must be mechanism where verified and recorded required. before publication.

Anthropic Claude Data Quality Under Anthropic's Anthropic Data current commercial Processing API architecture, Addendum processing may occur incorporated into in the United Anthropic States, Europe, Asia, Commercial Terms, and Australia; including EU Anthropic states SCCs. BOMSync commercial-customer must retain data storage remains evidence of the in the United terms/DPA States, unless applicable to its otherwise agreed. API account.

OpenAI General conversational AI OpenAI and disclosed OpenAI Data features where infrastructure Processing BOMSync-managed OpenAI API subprocessors may Addendum services are used process API Customer effective 1 Data in multiple January 2026; regions, including EEA/Swiss onward the EEA, UK, US, transfers use EU Australia, Brazil, SCCs or an Canada, India, adequacy Indonesia, Japan, decision; UK Data Mexico, Singapore, is covered by South Africa, South SCCs as amended Korea, Switzerland, by the UK and UAE, depending Addendum. BOMSync on service/account must retain configuration. evidence of the DPA applicable to its API account.

Stripe Payment processing, United States and Stripe billing, tax other locations used data-processing determination, and fraud by Stripe terms and prevention applicable transfer safeguards.

Claude Data Quality instruction and minimisation

Claude Data Quality is disabled by default and may be activated only by an authorized tenant administrator. BOMSync records the activation as a documented Customer instruction. When enabled, BOMSync may transmit production-derived statistics, structure, patterns, ranges, aggregates, and selected tenant-local values to Anthropic.

BOMSync does not include the AuthDB tenant company_id GUID in the request. Tenant-local integer identifiers are not accompanied by information identifying the tenant. Password, secret, token, and API-key style columns are excluded. The feature is not designed to transmit full-row database dumps. String content is patternized where the feature supports that transformation; production implementation must exclude detected sensitive or personally identifying fields from outbound analysis by default where they cannot be safely transformed. These controls reduce linkability and disclosure but do not render the transmitted Customer Data anonymous.

Customer BYOK

For supported AI Features, Customer may supply its own provider API key or credential. BOMSync stores supported Customer-provided AI credentials in Azure Key Vault and uses them solely to perform Customer-initiated or Customer-configured requests. The Customer-selected provider's terms govern provider-side processing for those BYOK requests. BYOK does not replace BOMSync-managed Azure AI Document Intelligence processing where that service is required by the feature.

PRE-PUBLICATION CONTROL --- Azure AI. Before publication, replace the bold verification sentence in the Azure AI row with the exact BOMSync production resource region(s) and Azure OpenAI / Foundry deployment type(s). This is an operational fact that cannot be safely inferred from the rest of the hosting architecture.

ANNEX IV --- UK International Data Transfer Addendum

Completed in accordance with the UK Addendum, version B1.0.

Table 1 --- Parties

                      Exporter                Importer

Start date Effective date of the Effective date of the Agreement Agreement

Parties' details Customer, as identified BOMSync, Inc., 809 in the Agreement and Paleface RR South, Annex I.A Spicewood, Texas 78669, USA

Key contact Customer's privacy privacy@bomsync.com contact on account

Table 2 --- Selected SCCs, modules and clauses

The EU SCCs as incorporated by Section 8.2 of this DPA, including Module Two or Module Three as applicable, the Clause 7 docking clause, Clause 9(a) Option 2 with a 30-day notice period, and Clause 11(a) optional language not included.

Table 3 --- Appendix information

  • Annex 1A (List of Parties): Annex I.A of this DPA
  • Annex 1B (Description of Transfer): Annex I.B of this DPA
  • Annex II (Technical and Organisational Measures): Annex II of this DPA
  • Annex III (List of Sub-processors): Annex III of this DPA

Table 4 --- Ending the Addendum when the Approved Addendum changes

Neither party may end the UK Addendum as set out in its Section 19.