Data Processing Addendum

Introduction

This Data Processing Addendum (“DPA”) forms part of and is incorporated into the Yori Terms and Conditions and any other agreement that expressly refers to it between Yori AI Limited (“Yori”) and its customers (“Customer”) governing Customer’s use of Yori’s services (the “Services”, and such terms or other agreement, the “Terms”). Yori and Customer are each a “Party” and together the “Parties”. To the extent that Yori processes any Personal Data on behalf of Customer in connection with Customer’s use of the Services, this DPA sets out Customer’s instructions for the processing of such Personal Data and the rights and obligations of both Parties. Except as expressly set out in this DPA, the Terms remain unmodified and in full force and effect. In the event of any conflict between this DPA and the Terms, this DPA shall prevail.

Definitions

For the purposes of this DPA, the following terms have the meanings set out below. Capitalised terms used but not defined in this DPA have the meanings given in the Terms. Other capitalised terms not defined in this DPA or the Terms have the meanings given to them in the applicable Data Protection Laws.

Roles of the Parties

The Parties acknowledge that, in relation to Personal Data received from or on behalf of Customer in providing the Services, Customer is the Controller and Yori is the Processor for the purposes of Data Protection Laws. Yori’s processing of personal data as a controller, such as for account administration, billing, security and its own business operations, is described in the Yori Privacy Policy and is not governed by this DPA.

Customer Obligations

Customer shall comply with all relevant Data Protection Laws in providing Personal Data to Yori in connection with its use of the Services, including through any third-party applications that Customer chooses to connect to the Services. Customer warrants that (a) all Personal Data was collected and at all times processed and maintained by or on behalf of Customer in compliance with all relevant Data Protection Laws, including any obligations to provide notice to and/or obtain consent from individuals, and (b) Customer has complied with the relevant Data Protection Laws (including having a lawful basis) and otherwise has all necessary rights, permissions, consents and authorisations to disclose the Personal Data to Yori and to enable Yori to process the Personal Data as set out in the Terms and this DPA. Customer shall notify Yori without undue delay if Customer determines that the processing of Personal Data under the Terms does not or will not comply with Data Protection Laws, in which case Yori shall not be required to continue processing such Personal Data.

Processing of Personal Data

The Parties agree that the details of processing are as described in Annex 1. In processing Personal Data under the Terms, Yori shall:

• only process Personal Data on Customer’s documented instructions, including with regard to transfers of Personal Data outside the United Kingdom, for the purposes described in Annex 1, unless required to do so by UK law, in which case Yori shall inform Customer of that legal requirement before processing unless that law prohibits this on important grounds of public interest. Customer’s use and configuration of the Services, including the features, connected applications and settings Customer chooses, forms part of Customer’s documented instructions;
• inform Customer immediately if (i) it determines that it can no longer comply with Customer’s instructions for the processing of Personal Data, its obligations under Data Protection Laws or the terms of this DPA, or (ii) in its opinion, an instruction of Customer infringes Data Protection Laws; and
• ensure that each employee or other person authorised to process Personal Data is subject to an appropriate duty of confidentiality with respect to such Personal Data.

Prohibitions

Yori shall not process Personal Data for any purpose other than providing the Services to Customer in accordance with Customer’s documented instructions and this DPA, except where required by law. Yori shall not sell Personal Data. For the avoidance of doubt, Yori shall not use Personal Data to train, fine-tune or otherwise improve large language models. If Yori receives (i) any legally binding request for disclosure of Personal Data by a law enforcement or regulatory authority; (ii) any notice, enquiry or investigation with respect to the Personal Data from any supervisory authority, regulator or similar body; or (iii) any complaint or request from a Data Subject, in each case relating to Yori’s processing of Personal Data for or on behalf of Customer under this DPA, then (to the extent permitted by law) Yori shall notify Customer.

Use of Sub-processors

• Customer grants Yori general written authorisation to engage the sub-processors set out in Annex 2, subject to the requirements of this section headed “Use of Sub-processors”.
• Yori shall inform Customer of any intended addition or replacement of a sub-processor, including any Third-Party AI Provider listed in Annex 2, at least ten (10) Business Days in advance, by updating Annex 2 and notifying Customer by email or through the Services. Customer may object to the addition or replacement within that period on reasonable and documented grounds relating to the confidentiality or security of Personal Data or the sub-processor’s compliance with Data Protection Laws. If Customer does not object within that period, Yori may proceed. If Customer objects, the Parties shall work together in good faith to resolve the objection. If, despite those good faith discussions, a resolution cannot be found, Customer’s sole remedy is to cease use of the Services, or of the feature of the Services affected by the addition or replacement.
• Yori uses AI routing providers to send Customer Content to the Third-Party AI Providers that serve the Third-Party Models selected by Yori for each feature of the Services. Yori’s primary AI routing provider is Vercel AI Gateway. Yori also uses OpenRouter as a fallback routing provider for document search embeddings. For each request, AI Gateway may send the request to any of the Third-Party AI Providers listed in Annex 2 that serve the selected Third-Party Model. Where the OpenRouter fallback is used, OpenRouter may route the request to a provider of its choosing that serves the selected embedding model. Yori does not identify to Customer the specific provider used for each individual request or generation.
• Yori shall engage sub-processors only under a written agreement that imposes obligations on the sub-processor that are no less protective of Personal Data than the obligations on Yori under this DPA.
• Where a sub-processor fails to fulfil its data protection obligations, Yori shall remain fully liable to Customer, in accordance with Data Protection Laws, for the performance of that sub-processor’s obligations.

Assistance

Yori shall, in relation to the processing of Personal Data and to enable Customer to comply with its obligations arising from that processing, provide assistance to Customer, at Customer’s cost, by:

• notifying Customer without undue delay of any request from a Data Subject to exercise their rights under Data Protection Laws and, taking into account the nature of the processing, assisting Customer by appropriate technical and organisational measures, insofar as this is possible, to respond to such requests, including by enabling Customer to access, correct or delete the relevant Personal Data;
• taking into account the nature of the processing and the information available to Yori, assisting Customer to meet its obligations under Articles 32 to 36 of the UK GDPR (and, where applicable, the EU GDPR), including in relation to security, data protection impact assessments and prior consultation with the relevant supervisory authority; and
• notifying Customer of any Personal Data Breach without undue delay after Yori becomes aware of it, and providing Customer with the information reasonably available to Yori to help Customer meet its own notification obligations.

Security Measures

Yori shall, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including the measures set out in Annex 3 or otherwise agreed and documented between Customer and Yori from time to time, and shall continue to comply with them for as long as Yori provides the Services to Customer. Yori shall provide data protection and security training to those employees and other persons authorised to access Personal Data.

Access and Audits

Yori shall make available to Customer all information necessary to demonstrate compliance with Article 28 of the UK GDPR (and, where applicable, the EU GDPR) and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, to the extent required of Yori by Data Protection Laws. Yori may meet this obligation in the first instance by providing Customer with information, documentation and reports reasonably necessary to demonstrate compliance. Customer may request such information or an audit (to the extent required by Data Protection Laws) no more than once every 12 months, on 30 days’ advance written notice to Yori, and only after the Parties, each acting reasonably, have agreed the scope, timing and duration of the audit, and provided that any auditor is bound by a duty of confidentiality. In no event shall Yori be required to give Customer access to information, facilities or systems to the extent doing so would cause Yori to breach confidentiality obligations owed to other customers or its legal obligations.

Deletion of Personal Data

Yori shall delete (or, at Customer’s option, return) all Personal Data within thirty days of the end of the provision of the Services to Customer, unless retention of the Personal Data is required by law, in which case Yori shall notify Customer without undue delay of that legal requirement and shall, on the expiry of that retention obligation, delete (or, at Customer’s option, return) the Personal Data. Copies of Personal Data held in backups are deleted in the ordinary course of backup rotation and remain subject to this DPA until they are deleted.

Data Transfers

Customer gives its prior general authorisation for Yori to transfer Personal Data outside the United Kingdom as required in connection with the provision of the Services, including to the sub-processors and Third-Party AI Providers listed in Annex 2, provided that Yori ensures that all such transfers are made in accordance with Data Protection Laws. For these purposes, Customer shall promptly comply with any reasonable request of Yori, including any request to enter into (a) where the UK GDPR applies to the transfer, the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued under section 119A of the Data Protection Act 2018; or (b) where the EU GDPR applies to the transfer, the standard contractual clauses adopted by the European Commission.

Annex 1

Details of Processing:

Annex 2

Authorised Sub-processors:

Some providers listed below also process personal data for which Yori is the controller, for example for billing, security and support. That processing is described in the Yori Privacy Policy and is outside this DPA.

Third-Party AI Providers that currently serve the Third-Party Models used in the Services, through AI Gateway:

Annex 3

Security Measures:

Yori maintains the following technical and organisational measures, in addition to the security measures implemented and maintained by the sub-processors listed in Annex 2:

• Encryption. All traffic to and from the Services is encrypted in transit using HTTPS (TLS). Stored data is encrypted at rest by Yori’s hosting and database providers.
• Access control. Authorised Users sign in through Yori’s authentication provider, with optional multi-factor authentication. Access to workspace data is scoped to the organisation and role of the signed-in user. Row-level security is enabled on all application database tables, and administrative access is restricted to authorised Yori personnel.
• Isolation of code execution. Code that Yori’s assistant runs for Customer executes in isolated sandboxes, with outbound network access denied during the working session.
• Application security. Yori applies rate limiting and abuse prevention, verifies the signatures of incoming webhooks, protects against cross-site request forgery, applies a Content Security Policy, validates uploaded files and restricts outbound requests made on behalf of users to prevent access to internal systems.
• Secrets management. Credentials and secrets are stored in managed secret stores and are not exposed to users’ browsers. Credentials for third-party applications that Customer connects are held by Yori’s connector platform provider.
• Data minimisation in operations. Yori’s AI usage records store token, cost and performance metadata rather than prompts or Outputs. Short-lived operational records are deleted automatically on a schedule, as described in the Yori Privacy Policy.
• Backups and resilience. Yori’s database provider maintains managed backups of the production database.
• Personnel and suppliers. Yori personnel with access to Personal Data are bound by confidentiality obligations. Yori carries out due diligence on sub-processors and engages them under written agreements.
• Incident response. Yori investigates suspected security incidents and notifies Customer of any Personal Data Breach as set out in the section headed “Assistance”.