Data Processing Agreement

About this DPA

This Data Processing Agreement (the “DPA”) consists of this Cover Page and the Common Paper DPA Standard Terms Version 1.1 at commonpaper.com/standards/data-processing-agreement/1.1 (the “DPA Standard Terms”). This Cover Page incorporates the DPA Standard Terms by reference. If this Cover Page and the DPA Standard Terms conflict, this Cover Page controls. A capitalized word has the meaning that this Cover Page or the DPA Standard Terms give it.

This DPA binds the parties when both sign this Cover Page, or when the Agreement refers to it.

This Cover Page follows the Common Paper DPA Cover Page, which Common Paper publishes under CC BY 4.0.

Parties

• Provider: Munito AI France, a French SAS registered with the RCS Paris under number 131 309 247, at 229 rue Saint-Honoré, 75001 Paris, France. Role: Processor, or Subprocessor when the Customer is a Processor. Contact: legal@munito.ai.
• Customer: the customer that the Agreement or the signature block names. Role: Controller, or Processor for its own controller. Contact: the email for notices in the signature block, or else the email of the owner of its Munito account.

Key terms

• Agreement: the Munito Terms of Service, or another agreement between the parties for the Service that refers to this DPA.
• Service: the Munito inference service: its API, its console, and the features that the documentation describes.
• Approved Subprocessors: the list for each region at trust.munito.ai/subprocessors. Annex III shows the list on the date of this Cover Page.
• Provider Security Contact: security@munito.ai.
• Security Policy: the controls of the trust center. Annex II shows them on the date of this Cover Page.
• Governing Member State: France, for EEA transfers. For UK transfers, the laws of England and Wales.
• California: Provider is a service provider under the California Consumer Privacy Act. Provider does not sell or share Customer Personal Data, does not keep, use or disclose it outside the direct business relationship with the Customer, and does not combine it with other personal data except as that law permits. Provider tells the Customer if it can no longer meet these obligations.
• Liability: no additional indemnity and no increased cap. Section 8 of the DPA Standard Terms applies as written.

Changes to the DPA Standard Terms

1. Notice of Subprocessor changes. In Sections 2.6.1 and 3.2.3 of the DPA Standard Terms, “10 business days” becomes “7 days”. Provider gives the notice in the updates of the trust center, and by email to the email for notices in the signature block and to each address that asks for the updates in the trust center.
2. Transfers from the EEA to the Customer. Provider is in the EEA. When it transfers Customer Personal Data to a Customer in a country without an adequacy decision, Module Four (Processor to Controller) of the EEA SCCs applies to that transfer, with the elections of Section 3.2.3 that apply to that Module.
3. Overflow. A request for which the Customer opts in to overflow can go through Cortecs to the providers that Cortecs lists at cortecs.ai/dpa, also to providers that Cortecs adds later. Provider gives no notice of those additions. The Customer stops overflow when it no longer opts in.

Annex I. Processing details

• Categories of Data Subjects: the Customer’s end users or customers, the Customer’s employees, and the persons that Customer content names, such as in documents.
• Categories of Personal Data: names, contact information, and the other personal data in the prompts, documents, images, audio and outputs that the Customer sends to or receives from the Service.
• Special Category Data: only as the Customer decides. The Customer sends it only with a legal basis and when it finds the measures of Annex II sufficient. Munito holds no certification as a host of health data (HDS), so the Customer must not use the Service to host personal health data where French law requires a certified host.
• Frequency of Transfer: continuous, with each request.
• Nature and Purpose of Processing: receiving, holding, using, protecting, returning and erasing data to provide the Service: inference with AI models, such as text generation, document extraction and transcription, and the storage features that the Customer uses.
• Duration of Processing: the term of the Agreement. Provider keeps the data of a request until it delivers the response, and stored content up to 30 days. Backups keep stored content up to 30 more days. Section 7 of the DPA Standard Terms applies at the end.
• Location: the region that the Customer selects, at the locations of Annex III.
• Competent supervisory authority: the CNIL, or the authority that Clause 13 of the EEA SCCs designates.

Annex II. Security measures

The Security Policy: the controls of the trust center on the date of this Cover Page.

Annex III. Approved Subprocessors

On the date of this Cover Page, Provider engages these Subprocessors for Customer Personal Data. A dash means that the Subprocessor does not process the data of that region. The current list is at trust.munito.ai/subprocessors.

Signature

The Terms of Service include this DPA, so it applies with no signature. For a signed copy, select Print at the top of this page, then print it or save it as a PDF. Sign the copy and send it to legal@munito.ai, and Munito returns a countersigned copy.

The parties sign this Cover Page, in its version of 18 October 2026, which incorporates the DPA Standard Terms Version 1.1.