Data processing addendum

1. Definitions

Terms defined in the Agreement have the same meaning here. Controller, processor, data subject, personal data, processing and supervisory authority have the meanings the GDPR gives them.

Customer Personal Data

Personal data in Customer Content that we process on the Customer's behalf under the Agreement.

Data Protection Law

The GDPR (Regulation (EU) 2016/679), the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978) and, where they apply to the processing, the UK GDPR and the Swiss Federal Act on Data Protection.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

SCCs

The standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

Sub-processor

A third party we engage that processes Customer Personal Data.

We, us

Beam SAS, 106 avenue de Versailles, 75016 Paris, France, registered with the Paris Trade and Companies Register under number 953 048 345.

2. Roles and scope

The Customer is the controller of Customer Personal Data and we are its processor. Where the Customer itself acts as a processor for its own clients, we are its sub-processor, and the Customer confirms that its controller has authorised our engagement on the terms of this DPA.

We process Customer Personal Data only to provide the Service. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects.

For account, billing and service data that we process for our own purposes (managing the customer relationship, billing, securing and improving the Service, and meeting our legal obligations) we act as an independent controller, as described in our privacy policy. This DPA does not apply to that processing.

3. Instructions

We process Customer Personal Data only on the Customer's documented instructions, unless EU or Member State law requires otherwise; in that case we tell the Customer before processing, unless that law forbids it.

The Customer's instructions are the Agreement, this DPA, and the choices its admins and Users make in the Service: which models are enabled, which apps are connected, what agents and workflows do, what is shared and with whom, whether web search is on, and the retention settings. Other instructions must be agreed in writing.

We tell the Customer promptly if, in our opinion, an instruction infringes Data Protection Law.

4. The Customer's responsibilities

The Customer is responsible for the lawfulness of the processing it instructs: having a legal basis, informing data subjects, and the accuracy of Customer Personal Data. It decides which models, apps and features process its data, and thereby which Sub-processors receive it and where (sections 7 and 8).

The Service is not designed for special categories of personal data or data about criminal convictions. The Customer brings such data into it only where it has a legal basis and has assessed that the measures in annex 2 are appropriate.

5. Confidentiality

We ensure that everyone authorised to process Customer Personal Data is bound by an obligation of confidentiality, and that they access it only as far as needed: to provide support the Customer asks for, to operate and secure the Service, or to comply with the law.

6. Security

We implement the technical and organisational measures described in annex 2, which ensure a level of security appropriate to the risk, as Article 32 of the GDPR requires. We may change them over time, provided the overall level of protection does not decrease.

7. Sub-processors

The Customer gives us general authorisation to engage Sub-processors. Those engaged today are listed in annex 3 and on the sub-processors page, which is the current list.

Beam engages the following sub-processors: Amazon Web Services (the machine this product runs on), Clerk (sign-in, sessions and workspace membership), the model provider that answers (generates replies, documents and summaries, so it receives the conversation and whatever it is given to work on), Pipedream (runs the managed connectors to your other tools and holds the authorisation to reach them), Stripe (subscriptions, payment and invoices), Resend (delivers transactional email), Twilio SendGrid (delivers transactional email), Tavily (answers a web search with pages from the open internet), Voyage AI (reranks retrieved passages so the most relevant reach the model), Sentry (collects errors so failures can be fixed), and Pexels (supplies stock photography for generated presentations).

Several are used only when the Customer turns on the feature that needs them, and the model providers that receive requests are those whose models the Customer enables. Where the Customer supplies its own provider key, or a model it hosts, requests go directly to that provider under the Customer's own agreement with it, and for those requests the provider is not our Sub-processor.

We impose on each Sub-processor, by written contract, data protection obligations that offer at least the protection of this DPA, and we remain liable to the Customer for its performance.

Before a new Sub-processor starts processing Customer Personal Data, we publish the change on the sub-processors page and email the administrative contacts of every workspace at least 15 days in advance. The Customer may object in writing within those 15 days on reasonable data protection grounds. We will then look for an alternative in good faith; if there is none, the Customer may terminate the affected subscription before the change takes effect, and we refund the fees paid for the period after termination. If we must replace a Sub-processor urgently for reasons beyond our control, we give notice as soon as we can and the same right to object applies from that notice.

8. International transfers

We host the Service and Customer Personal Data in France. We transfer Customer Personal Data outside the European Economic Area only to Sub-processors established there, as needed for the features the Customer uses, or on the Customer's other documented instructions.

Each such transfer relies on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for recipients certified under it, or on the SCCs (module three, processor to processor) between us and the Sub-processor, with supplementary measures where an assessment shows they are needed. On request we provide a copy of these safeguards, with commercial terms removed. Where UK or Swiss law applies to a transfer, we put in place the additional safeguards it requires on request.

A model provider may process requests outside the European Union under its own terms (annex 3). A Customer that needs requests to stay with a particular provider can restrict its workspace to that provider's models and use its own key.

If a public authority asks us for Customer Personal Data, we try to redirect it to the Customer, tell the Customer unless the law forbids it, challenge a request we consider unlawful, and disclose only what we are legally obliged to.

9. Data subjects' requests

If a data subject asks us directly to exercise their rights over Customer Personal Data, we pass the request to the Customer without undue delay and do not answer it ourselves unless the Customer asks us to.

The Service lets the Customer handle most requests itself: people can delete their own chats, files, agents and workflows and download files; admins can remove members, export the member list and set retention periods; and the owner can delete the whole workspace. Where that is not enough, we help the Customer with appropriate technical and organisational measures, as far as reasonably possible.

10. Personal data breaches

We notify the Customer of a Personal Data Breach without undue delay after becoming aware of it, by email to its workspace admins.

The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. We add information as it becomes available.

We take reasonable steps to contain the breach and limit its effects, and help the Customer meet its obligations to notify the supervisory authority and data subjects. Notifying a breach is not an admission of fault.

11. Impact assessments and consultations

With the information available to us, we provide reasonable assistance for the Customer's data protection impact assessments and prior consultations with supervisory authorities where they concern the Service. Assistance that needs significant effort beyond providing existing documentation may be charged at a rate agreed in advance.

12. Information and audits

We make available the information needed to demonstrate compliance with Article 28 of the GDPR and this DPA: this DPA and its annexes, the sub-processor list, and written answers to reasonable security questionnaires. We keep the records of processing that Article 30(2) of the GDPR requires.

Where that information is not enough, the Customer may audit our compliance, itself or through an independent auditor bound by confidentiality who is not our competitor: no more than once a year, unless a supervisory authority requires it or a Personal Data Breach has occurred; on reasonable prior written notice; during business hours; and without disrupting the Service or exposing other customers' data. The Customer bears the cost of the audit.

13. Deletion and return

During the Agreement, the Customer can delete Customer Personal Data at any time with the Service's own tools, and the retention periods its admins set delete chats, files, workflow runs and audit entries automatically once they reach the age chosen.

Before the Agreement ends, the Customer can download its files and ask us for an export of its workspace's records.

When the Agreement ends, we delete Customer Personal Data within 30 days, unless EU or Member State law requires us to keep it; anything kept stays protected by this DPA and is processed only for that purpose. A workspace its owner deletes is deleted at once. We confirm deletion in writing on request.

14. Liability

Each party's liability under this DPA is subject to the limits in the Agreement, without prejudice to the rights of data subjects under Article 82 of the GDPR.

15. Duration, precedence and governing law

This DPA applies for as long as we process Customer Personal Data for the Customer. If it conflicts with the Agreement on the protection of personal data, this DPA prevails; where the SCCs apply, they prevail over both.

Where the California Consumer Privacy Act applies, we act as a service provider: we do not sell or share personal information received from the Customer, and use it only to provide the Service.

This DPA is published in French and English. If the two versions differ, the French version prevails.

This DPA is governed by French law, and the courts of Paris, France, have jurisdiction, without prejudice to the SCCs' own provisions on governing law and jurisdiction.

Annex 1: Details of the processing

Subject matter

Providing the Service under the Agreement.

Duration

The term of the Agreement, plus the deletion period in section 13.

Nature

Hosting and storage; indexing and search; transmission to the model providers the Customer enables and to the connected apps it chooses; running agents, workflows and scheduled tasks; transcribing recordings; generating documents, presentations, spreadsheets and images; sending notifications; support at the Customer's request.

Purpose

Providing the Service to the Customer and its Users, as the Customer configures and uses it.

Data subjects

The Customer's Users; people whose personal data the Customer or its Users bring into the Service, such as colleagues, customers, suppliers, candidates, meeting participants and other contacts; people who interact with agents or pages the Customer shares.

Personal data

Users' identification and contact data (name, email, profile picture, role); content: messages, prompts, files, recordings and transcripts, knowledge and Output; configuration that contains personal data: instructions, memories, agents and workflows; data from connected apps; usage and log data: timestamps, the model used, request counts and audit entries.

Special categories

None required by the Service; see section 4.

Frequency

Continuous, while the Customer uses the Service.

Retention

As set by the Customer's retention settings and deletions, and in any case until 30 days after the Agreement ends.

Location

France for hosting; Sub-processors as listed in annex 3.

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

The same list as the sub-processors page. The location column names each provider's principal establishment, as that provider publishes it.

Version history