Draft pending counsel sign-off. The operative body of this DPA is a published standard form, the Bonterms Data Protection Addendum v2.0 (Attachment Version), which we incorporate by reference and do not edit. The DPA Details in Section 2, including the Additional Terms, are ElasticD3M's own and are pending sign-off by counsel. Questions: privacy@elasticd3m.com.
1. What this DPA consists of
Where ElasticD3M, LLC ("Provider") processes Customer Personal Data on Customer's behalf, that processing is governed by the Bonterms Data Protection Addendum v2.0 (Attachment Version) (the "Bonterms DPA"), published by Bonterms and incorporated here by reference, together with the DPA Details below. The Terms of Service are the Main Agreement, and they expressly incorporate this DPA, including the DPA Details, as an Attachment. Capitalized terms not defined here have the meanings given in the Bonterms DPA.
The Bonterms DPA carries its own Exhibit A (cross-border transfer mechanisms, including the EU Standard Contractual Clauses and the UK Addendum) and Exhibit B (California), so that machinery is in the standard form rather than reconstructed by us. Among other things it sets: incident notice without undue delay and no later than forty-eight (48) hours after Provider becomes aware of a Security Incident (Section 5.2); at least 30 days' notice of a new Subprocessor, with a right to object (Sections 4.3 and 4.4); assistance with data subject requests (Section 7); return and deletion (Section 8); and audits (Section 9).
The Bonterms DPA is © 2026 Bonterms, Inc. and published under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). ElasticD3M is not affiliated with or endorsed by Bonterms, and the DPA Details below are ours, not Bonterms'.
2. DPA Details
2.1 Key Terms
| Main Agreement | The Terms of Service between Customer and ElasticD3M, LLC accepted at the Order. |
| DPA Effective Date | The Effective Date of the Main Agreement. |
| Subprocessor List | ai4cmmc.ai/subprocessors |
| Designated EU Governing Law | N/A |
| Designated EU Member State | N/A |
2.2 Processing Details
| Customer (data exporter) | The organization identified in the Order. Role: Controller (a "business" under the CCPA). Contact: the email address on file. |
| Provider (data importer) | ElasticD3M, LLC, 7700 Broadway St, Ste 104 PMB1083, San Antonio, TX 78209. Role: Processor (a "service provider" under the CCPA). Contact for data protection: privacy@elasticd3m.com. Activities: providing Enclave AI™ under the Main Agreement. |
| Categories of Data Subjects | Users; Customer's employees, other personnel and business contacts, including those whose accounts appear in the identity and audit-log metadata Customer's connectors report. |
| Categories of Customer Personal Data | Contact information (name, business email, phone, job title); account information; professional information; unique identifiers (sign-in names, email addresses and principal identifiers of Customer's own user accounts, where a configuration finding needs them); communications information (email with ai4cmmc.ai addresses). |
| Sensitive or Special Categories | None. Customer does not submit Sensitive Data, CUI or ITAR-controlled data (Terms Section 2.6). |
| Frequency of transfer | At intake, on each connector scan (about every seven days) and on each delivery cycle, and whenever Customer submits information. |
| Nature and purpose | Processing operations required to provide the Cloud Service under the Main Agreement and carry out Customer Instructions: reading configuration metadata through the read-only connectors Customer grants, recording evidence Customer supplies, preparing the deliverables, and sending account and delivery email. |
| Duration / retention | Concurrent with the term of the Main Agreement and thereafter under Section 8 of the Bonterms DPA and Section 12.4 of the Bonterms Standard Online Cloud Terms incorporated in the Main Agreement (deletion within 60 days of Customer's request). |
| Transfers to Subprocessors | As described in the Subprocessor List, for the purposes described there. |
| Security Measures | See Main Agreement (Terms of Service, Section 3.4). |
2.3 Subprocessor Notice Method
Email to the account's primary contact at the address on file, as the Bonterms DPA defines the Subprocessor Notice Method, and an update to the Subprocessor List.
2.4 Additional Terms
The following additions to the Bonterms DPA control in the event of conflict:
- Location (modifies Section 10.1). Provider stores Customer Personal Data in the United States. Provider transfers it outside the United States solely as it passes through the Subprocessors on the Subprocessor List, at the locations the list states for each of them. A Customer that would need a Restricted Transfer should tell Provider before its Order; Exhibit A applies to any Restricted Transfer that occurs.
- What the connectors read. Connectors read configuration metadata only, through the read-only roles and permissions Customer grants and may revoke at any time. When Customer disconnects a connector in the Service, Provider deletes the credential it stores for that connector.
- Liability (confirms Section 2.6). Section 2.6 of the Bonterms DPA already makes claims brought in connection with this DPA subject, to the fullest extent Data Protection Laws permit, to the exclusions and limitations in the Main Agreement. In the Main Agreement those are Sections 5.2 and 5.3 of the Terms of Service, which supersede Sections 14 and 15 of the Standard Terms: one aggregate liability cap for every claim, with no separate, higher or enhanced cap for a breach of this DPA or of the Security Measures, and no indemnity from Provider. This DPA creates no liability outside that cap, except where Data Protection Laws, or Standard Contractual Clauses that apply under Exhibit A, do not permit the limitation.
Effective Date: September 24, 2026 · Version: 2.0 · Operative body: Bonterms Data Protection Addendum v2.0 (Attachment Version), by reference
Replaces all prior versions of the Data Processing Addendum published at ai4cmmc.ai before this date.