Data Processing Addendum

The client is the owner of the database and the party that determines the purposes of the processing. Ankora is the holder of the database and processes the data on the client's behalf.

Ankora processes personal data only on the client's documented instructions and for the purpose of providing the service. What constitutes an instruction and a written authorization is defined in the Service Terms, section 3.

If Ankora believes that an instruction from the client conflicts with applicable law, it will say so and will not carry it out until the matter is clarified.

The sole purpose of the processing is providing the service. Ankora does not process the data for any other purpose, does not sell it, and does not use it for its own ends.

The client specifies in writing the systems to which access is granted, the scope of that access, and the actions Ankora may perform in each system: view only, update, or create new records.

Access credentials that the client provides to Ankora for its systems are stored in Ankora's credentials vault only, and not in messages, documents or personal password managers. Access to them is limited to the members of the Ankora team assigned to the client. Every view of them requires identity verification on that person's own device, and is recorded in the audit log with the viewer, the time, and the task in the course of which it took place. A blocked attempt to view is recorded as well.

On the client's request, Ankora will provide it with the list of views of its access credentials.

The client may ask at any time for access credentials to be removed, and Ankora will delete them from the vault within one business day. Ankora recommends that the client change a password provided to it once it is no longer needed.

Access is granted to identified individuals only. Each member of the Ankora team works under a personal, identified user in Ankora's systems, in a way that allows the activity to be monitored and controlled.

Every material action is recorded in an audit log with the actor, the time, the entity and the state before and after.

Ankora does not access data that the task does not require, even where it is technically accessible. The list of people holding permissions is available to the client on request.

Every person acting on Ankora's behalf who is granted access has signed a personal undertaking of confidentiality and of use of the data for the purpose of the task alone. The undertaking survives the end of their work at Ankora.

When a person's work at Ankora ends, their permissions in Ankora's systems are revoked, and Ankora notifies the authorized contact at the client so that the client can revoke the permissions granted in its own systems, and gives the client the list of its access credentials that person viewed in the ninety days before their work ended, so that the client can change them.

Encryption in transit and at rest, permissions on a need basis, structural separation between clients in the portal, an audit log, rate limiting, and documented periodic security reviews. The full and current detail is in the security and trust page, Document 4.

Access credentials for the client's systems are encrypted separately for each record with AES-256-GCM, under an encryption key that is not stored in the database and is not included in backups.

The client approves the use of the sub-processors listed in the privacy policy, section 7.

Ankora's engagement with each sub-processor includes information security and confidentiality undertakings no weaker than those in this addendum. Ankora is responsible for the acts of its sub-processors as for its own.

Ankora will update the list of sub-processors in the privacy policy, section 7, at least thirty days before a new sub-processor has access to the client's data. A client that has asked in writing to be notified will also receive the notice by email, at the same time. A client that objects on reasonable security or privacy grounds will say so within fourteen days of the update, and the parties will work in good faith to find an alternative. If none is found, the client may terminate the engagement at the end of the following month, and this will not be treated as a breach on the client's part.

Ankora integrates AI systems into the operational layer, as described in the privacy policy, section 6.

Ankora does not train models on the client's data. Neither its own models nor those of others. Ankora's engagement with its AI providers prohibits the provider from training models on data that passes through it.

A decision made towards the client or towards a third party is always made by a person. The data passed to the AI systems is limited to what the task requires.

Access credentials for the client's systems are never passed to AI systems.

The client may ask that a task, a document, or all of its data not be worked on with AI. The request is marked in Ankora's system. From the moment it is marked, the marked data is not fed into the AI tools Ankora works with and is handled by a person only. Calls continue to be recorded and transcribed as described in the privacy policy, section 5. The mark does not apply to data processed with AI before it was recorded.

Calls and meetings with the Ankora team are recorded and transcribed, and the record serves operational continuity, quality, and input to the AI systems.

The client is responsible for informing its employees and anyone acting on its behalf who takes part in calls with Ankora, and for obtaining any consent required under the law that applies to the client. A client that asks that its calls, or those of its employees, not be recorded will say so, and Ankora will honor the request.

A data subject request that reaches Ankora and concerns the client's data will be passed to the client within three business days and will not be answered by Ankora.

Ankora will assist the client in locating, correcting, exporting or deleting data, to a reasonable extent and at no additional charge, so that the client can meet the response deadline set by the law that applies to it.

Ankora will notify the client of a serious security incident affecting the client's data within twenty four hours of becoming aware of it, including before a full investigation. The notice will include what is known at that point: what happened, which data is involved, what has been done and what is required of the client.

Reporting to the Israeli Privacy Protection Authority and to data subjects is the client's responsibility as owner of the database, and Ankora will assist with the information in its possession.

Once a year Ankora will report to the client on its compliance with the undertakings in this addendum, and will complete a control questionnaire provided by the client.

The client may conduct an audit, itself or through an auditor on its behalf who is not a competitor of Ankora, once a year, on seven days notice, during service hours, and without prejudicing the confidentiality of other clients. A further audit in the same year, other than one following a security incident, will be at the client's expense.

The data is stored on the servers of the sub-processors, mostly in the United States and partly in the European Union and in Israel, and some traffic passes through intermediate servers in other countries, as detailed in section 7 of the privacy policy. The client approves the transfer.

This addendum is in force for as long as the engagement is active and for as long as Ankora holds the client's data.

On termination Ankora revokes the permissions under its control within three business days, and makes a full export of the data available to the client for up to thirty days.

Ankora will delete the data in its possession within sixty days of termination, other than data the law requires it to retain and backups that are erased in the ordinary backup cycle. On completion of the deletion Ankora will give the client a closing report setting out what was deleted, when, and what was retained and why.

Access credentials for the client's systems are deleted from the vault within three business days of termination, together with the revocation of permissions, and are not part of the export window. Encrypted copies of them in backups cannot be opened without a key that is not included in the backup, and are erased in the ordinary backup cycle.

Ankora's liability under this addendum is subject to the liability cap in the Service Terms, section 13, except in matters that the law does not permit to be limited.

This addendum applies to the processing of personal data only. Every other matter is governed by the Service Terms and the proposal.

In the event of a conflict on a matter of privacy or information security, this addendum prevails over the Service Terms. On every other matter, the Service Terms prevail.

Applies only to a client to whom the GDPR applies. The client is the controller and Ankora is the processor within the meaning of Article 28.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are as set out in sections 2 and 13 above.

Ankora will assist the client in meeting its obligations under Articles 32 to 36, including security of processing, breach notification and data protection impact assessment, to a reasonable extent and taking account of the information available to it.

Transfers of personal data from the European Union to Israel rely on the European Commission's adequacy decision for Israel, reaffirmed in January 2024 and subject to periodic review. Onward transfer to the sub-processors in the United States and in other countries outside the European Economic Area relies on those providers' own transfer mechanisms, including standard contractual clauses or certification under the EU and US Data Privacy Framework.

Data transferred to Israel from the European Economic Area is also subject to the Israeli Privacy Protection Regulations on data transferred to Israel from the EEA, and Ankora acts in accordance with them.