Effective Date: May 5, 2026 | Last Updated: August 6, 2026
This Data Processing Agreement (“DPA”) forms part of the End User License Agreement (“Agreement”) between AI Bizlutions, LLC (“Processor,” “we,” “us”) and you (“Controller,” “Customer,” “you”) and governs the processing of personal data by AI Bizlutions on behalf of the Customer.
This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), as applicable.
The Customer is the Controller (or Business, under CCPA) of Personal Data. AI Bizlutions is the Processor (or Service Provider, under CCPA) of such data. AI Bizlutions processes Personal Data only on behalf of and under the documented instructions of the Customer.
Where the Customer is an Agency Partner reselling access to its own business clients, or is a client holding a sub-account under such an Agency Partner, Section 2A applies in addition to this Section 2.1.
AI Bizlutions processes Personal Data for the duration of the Agreement to provide the Platform services described in the Terms of Service. Processing terminates upon expiration or termination of the Agreement, subject to Section 10 (Data Retention and Deletion).
| Purpose | Description |
|---|---|
| Service delivery | CRM, invoicing, communications, automation, knowledge base |
| AI content generation | Text, social media posts, images, analytics (via Google Gemini) |
| Email campaigns | Sending, tracking, and managing email communications |
| Analytics | Usage metrics, reporting, business intelligence |
| Integration sync | Synchronizing data with connected third-party services |
Where Section 2A applies, these categories are read to include the Agency Partner’s employees and authorized users, the personnel and authorized users of each Client holding a sub-account, and the Client’s own customers and contacts (“Client End-Users”).
This Section 2A applies only where an Agency Partner provides access to the Platform to its own business clients through sub-accounts, as permitted by the Agency Partner section of the Terms of Service. It qualifies Section 2.1 for those arrangements and does not otherwise change this DPA.
If a marketing agency set up this account for you, read this first. The following is a plain-language summary of this Section 2A, written for the business whose data is in the account. The numbered clauses below are what actually govern; where this summary and a clause differ, the clause wins.
Notwithstanding the involvement of an Agency, in respect of Client Personal Data:
This allocation reflects the requirement in the Agreement that each Client user accept the Agreement and our Privacy Policy directly, identifying AI Bizlutions as the operator of the Platform, before the sub-account is activated. No white-label configuration changes the allocation of roles in this Section 2A, and no such configuration changes who operates the Platform or who processes Client Personal Data.
An Agency does not, by virtue of the reseller arrangement, become a Controller of Client Personal Data, and acquires no right to Client Personal Data on its own account.
Where a Client has authorized its Agency to administer the Client’s sub-account, configuration and administrative actions taken by the Agency within that sub-account constitute documented instructions of the Client for the purposes of Section 4.1. The Client remains responsible for instructions given on its behalf.
A Client may withdraw its Agency’s authority at any time, in the Platform, at Settings → Account → Your agency → Remove access. That control takes effect immediately: the link between the two accounts is severed, and any session in which the Agency is signed in as the Client is terminated at the same moment. A Client may also make the request by emailing dpo@aibizlutions.com from the address it uses to sign in, stating that it wishes to remove its Agency’s access and naming its business; AI Bizlutions shall give effect to an emailed request within five (5) business days and shall confirm by email once it is done.
Removing an Agency’s access does not delete or move any of the Client’s data and does not cancel the Client’s account. Where the Agency’s subscription was paying for the Client’s account, the period the Agency has already paid for is unaffected, and the account bills to the Client at the published price of its own plan from the start of the next period. The Client is told that price, and the date it begins, before it confirms.
Where AI Bizlutions receives conflicting instructions from an Agency and its Client in respect of Client Personal Data, the Client’s instruction prevails. AI Bizlutions may suspend the affected processing until the conflict is resolved and shall notify both parties.
An Agency may not instruct AI Bizlutions to process Client Personal Data for the Agency’s own purposes. Processing for the Agency’s own purposes would require the Agency to hold its own lawful basis as a Controller and is outside the scope of this DPA.
The Client, as Controller, is responsible for responding to requests from Data Subjects in respect of Client Personal Data, including requests from Client End-Users. Section 4.5 applies between AI Bizlutions and that Client.
Where a Data Subject request in respect of Client Personal Data is received by AI Bizlutions, AI Bizlutions shall notify the Client within the period specified in Section 4.5 and shall additionally notify the Agency. Where such a request is received by an Agency, the Agency shall forward it to the Client without undue delay and in any event within five (5) business days.
The self-service export and erasure mechanisms described in Section 10 operate at sub-account level and are available to each Client in respect of its own Client Personal Data. AI Bizlutions shall not respond directly to a Data Subject request in respect of Client Personal Data unless authorized by the Client.
Where a Security Incident affects Client Personal Data, AI Bizlutions shall notify both the Client and its Agency, each within the period specified in Section 5.1. Notice to one does not satisfy the obligation to notify the other, and neither notice is conditional on the other being delivered or acknowledged.
Notification to the Agency is given because the Agency is the customer of record and holds the operational relationship. It does not transfer to the Agency any obligation of the Client as Controller, including any obligation to notify a supervisory authority under Article 33 GDPR or to notify Data Subjects under Article 34 GDPR.
Where a Security Incident affects only Agency Personal Data, notice is given to the Agency alone.
Annex B applies to each Client on the same terms as to any other Customer. AI Bizlutions shall give the advance notice required by Section 4.4 to the Client and to its Agency. The right to object to a new Sub-Processor under Section 4.4 belongs to the Client as Controller; an Agency may exercise that right on a Client’s behalf only where authorized by that Client to do so.
An Agency may not present the Sub-Processors listed in Annex B as its own sub-processors or suppliers, and may not represent that Client Personal Data is processed other than as described in this DPA.
In respect of Agency Personal Data, the Agency is the Controller and AI Bizlutions is the Processor, and this DPA applies between AI Bizlutions and the Agency in the ordinary way under Section 2.1. Where an Agency records information about a Client’s personnel in the Agency’s own account, the Agency is the Controller of that record and warrants that it has given the notices and holds the lawful basis that applicable law requires.
Each Agency represents and warrants that: (a) it is authorized by each Client to administer that Client’s sub-account and to give instructions on that Client’s behalf; (b) it has provided each Client with privacy disclosures at least as protective as our Privacy Policy; (c) it will not hold itself out as the operator of the Platform or as the Processor of Client Personal Data; and (d) its agreements with its Clients do not purport to vary, limit, or override this DPA.
Nothing in an Agency’s agreement with a Client alters the rights or obligations of AI Bizlutions or of that Client under this DPA. Where such an agreement conflicts with this DPA, this DPA governs as between AI Bizlutions and the Client.
Client Personal Data belongs to the Client. Termination of an Agency Partner subscription, or removal of a Client from an Agency’s account, does not transfer Client Personal Data to the Agency and does not extinguish that Client’s rights under Section 10. On termination of an Agency’s reseller rights, AI Bizlutions shall (a) terminate the Agency’s administrative access to each affected sub-account, and (b) apply Section 10 to each affected Client separately, by reference to that Client’s own subscription status rather than the Agency’s.
An Agency shall not retain copies of Client Personal Data obtained through a Client’s sub-account after its administrative access ends, except where it holds that data as an independent Controller with its own lawful basis.
Where a Client is established in the EEA, the United Kingdom, or Switzerland, the Standard Contractual Clauses incorporated by Annex C apply between that Client (as data exporter and Controller) and AI Bizlutions (as data importer and Processor) under Module 2, in the same manner as for any other Customer. An Agency is not a party to those Clauses in respect of Client Personal Data and is not the data exporter for that data.
The Customer shall:
AI Bizlutions shall:
Process Personal Data only on documented instructions from the Customer (which include the instructions specified in this DPA and the Agreement), unless required to do so by applicable law. If AI Bizlutions is required by law to process Personal Data other than as instructed by the Customer, AI Bizlutions will notify the Customer of this requirement prior to processing (unless prohibited by law from doing so). If AI Bizlutions becomes aware that a Customer instruction infringes GDPR or other applicable data protection law, AI Bizlutions shall immediately inform the Customer.
The Customer may provide documented instructions to AI Bizlutions by: (a) the terms of this DPA and the Agreement, (b) configuration of the Platform settings (e.g., data retention settings, integration enablement, email campaign targeting), which constitute documented instructions, (c) written communication to dpo@aibizlutions.com for instructions not covered by (a) or (b). AI Bizlutions shall confirm receipt of instructions received under (c) within five (5) business days.
Ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
Implement and maintain appropriate technical and organizational measures to protect Personal Data, including:
AI Bizlutions shall not engage a Sub-Processor without prior written authorization from the Customer. The Customer provides general written authorization for the Sub-Processors listed in Annex B. AI Bizlutions shall:
Before engaging any new Sub-Processor, AI Bizlutions shall conduct due diligence to assess the Sub-Processor’s ability to provide the level of data protection required by this DPA. Due diligence includes review of: security certifications, DPA/contractual commitments, data processing location(s), and applicable transfer mechanisms.
If the Customer objects to a new Sub-Processor within the 30-day notice period, AI Bizlutions will use commercially reasonable efforts to make available an alternative arrangement. If no alternative is feasible, either party may terminate the affected services with thirty (30) days’ notice.
AI Bizlutions maintains the current list of authorized sub-processors at https://app.aibizlutions.com/sub-processors.html. Customers may subscribe to email notifications of sub-processor changes by emailing dpo@aibizlutions.com with subject ‘Sub-processor notifications.’ The 30-day advance notice period begins on the date the notification email is sent.
Where Section 2A applies, Section 2A.6 governs how this notice and the objection right operate between an Agency and its Clients.
AI Bizlutions shall promptly notify the Customer of any request received directly from a Data Subject and shall assist the Customer in responding to such requests, including requests for access, rectification, erasure, restriction, portability, and objection. AI Bizlutions shall notify the Customer of any Data Subject request within forty-eight (48) hours of receipt. AI Bizlutions shall provide reasonable technical assistance to enable the Customer to respond to Data Subject requests within the timeframes required by applicable law (one month under GDPR, 45 days under CCPA). AI Bizlutions shall not respond directly to Data Subject requests unless authorized by the Customer. Where Section 2A applies, Section 2A.4 identifies which party is responsible for responding.
AI Bizlutions shall provide reasonable assistance to the Customer in:
AI Bizlutions shall maintain a record of processing activities carried out on behalf of the Customer in accordance with Article 30(2) GDPR. This record shall include: the categories of processing, transfers to third countries, a general description of technical and organizational security measures, and the name and contact details of each Controller on whose behalf processing is carried out. AI Bizlutions shall make this record available to supervisory authorities upon request.
AI Bizlutions shall notify the Customer without undue delay (and in no event later than seventy-two (72) hours) after becoming aware of a Security Incident affecting Customer Personal Data. Notification shall include:
Where Section 2A applies, Section 2A.5 identifies who receives this notification.
AI Bizlutions shall cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each Security Incident. AI Bizlutions shall not inform any third party of a Security Incident without first consulting with the Customer, unless required by law.
Following initial notification, AI Bizlutions shall provide the Customer with regular updates on the investigation and remediation of the Security Incident until resolution. Updates shall be provided at least every 72 hours during active investigation.
AI Bizlutions shall preserve all evidence related to the Security Incident for a minimum of twelve (12) months following the incident, including system logs, access records, and forensic data. Such evidence shall be made available to the Customer and relevant supervisory authorities upon request.
All Customer Personal Data is stored in AWS US-East-2 (Ohio, United States). Where Personal Data is transferred from the EEA, UK, or Switzerland to the United States, AI Bizlutions relies on:
AI Bizlutions intends to pursue EU-US Data Privacy Framework self-certification with the U.S. Department of Commerce. Until such certification is completed and publicly listed at https://www.dataprivacyframework.gov, international transfers rely exclusively on Standard Contractual Clauses and supplementary measures described in Section 6.2 below.
Pursuant to EDPB Recommendations 01/2020 on supplementary measures, AI Bizlutions has conducted a Transfer Impact Assessment (TIA) for personal data transfers from the EEA/UK/Switzerland to the United States:
AI Bizlutions has assessed the following U.S. surveillance laws relevant to data transfers:
Customer personal data processed by AI Bizlutions consists primarily of business contact information, CRM records, invoicing data, and communications content for small-to-medium business operations. This data is unlikely to be of intelligence interest to U.S. government agencies. AI Bizlutions has no government contracts and does not process data for government agencies.
As of the effective date of this DPA, AI Bizlutions has received zero government access requests, zero national security letters, zero FISA orders, and zero warrants compelling disclosure of Customer personal data. AI Bizlutions will maintain a transparency page at https://app.aibizlutions.com/transparency.html disclosing the number of government requests received (updated at minimum annually).
In addition to the SCCs, AI Bizlutions implements the following supplementary technical and organizational measures:
Based on this assessment, AI Bizlutions concludes that the combination of Standard Contractual Clauses and supplementary measures provides an essentially equivalent level of protection to that guaranteed within the EEA. The risk of U.S. government access to Customer personal data that would undermine the protections of the SCCs is assessed as low given the nature and volume of data processed, AI Bizlutions’s non-telco status, and the additional technical measures in place.
The obligation under Article 27 GDPR to designate an in-territory representative applies to controllers not established in the Union that offer goods or services to, or monitor the behaviour of, data subjects in the Union (GDPR Art. 3(2)). AI Bizlutions currently offers the Platform only to users located in the United States; new account registration from all other countries — including EU Member States, EEA countries, and the United Kingdom — is unavailable at this time. Accordingly, the Article 27 designation requirement is not triggered at this time.
Should AI Bizlutions extend its services to residents of a given jurisdiction in the future, all applicable regulatory requirements (including any representative designation obligations) will be satisfied prior to that jurisdiction's launch. Current geographic availability status is published at https://app.aibizlutions.com/representatives.html. General data protection enquiries may be directed to dpo@aibizlutions.com.
For transfers of personal data subject to the Swiss Federal Act on Data Protection (FADP):
The Customer may audit AI Bizlutions’s compliance with this DPA up to once per calendar year, upon thirty (30) days’ advance written notice. Audits shall be conducted during normal business hours, shall not unreasonably interfere with AI Bizlutions’s operations, and shall be at the Customer’s expense.
AI Bizlutions shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. Where available, AI Bizlutions may satisfy audit requests by providing relevant certifications, audit reports, or third-party assessments. Note: SOC 2 Type II certifications referenced in Annex B pertain to AI Bizlutions’s sub-processors (e.g., AWS, Stripe) and not to AI Bizlutions itself, unless and until AI Bizlutions obtains its own certification.
AI Bizlutions commits to publishing an annual transparency report at https://app.aibizlutions.com/transparency.html disclosing: (a) the number of government access requests received, (b) the number of data subject requests processed on behalf of Customers, and (c) the number of Security Incidents reported. The first report will be published within twelve (12) months of the effective date of this DPA.
To the extent the CCPA/CPRA applies to the processing of Personal Data:
Each party’s total aggregate liability under this DPA shall be subject to the limitations of liability set forth in the Agreement. Nothing in this DPA limits or excludes either party’s liability for fraud, intentional misconduct, or any liability that cannot be limited by applicable law.
Notwithstanding the foregoing limitation, the liability cap in the Agreement shall NOT apply to: (a) either party’s obligations under Articles 82 and 83 GDPR (data subject compensation and regulatory fines), (b) AI Bizlutions’s indemnification obligations under Section 9.1 below with respect to GDPR violations caused by processing outside of or contrary to the Customer’s lawful instructions, or (c) either party’s liability for willful breaches of this DPA.
AI Bizlutions shall indemnify and hold the Customer harmless from and against any fines, damages, costs, and expenses (including reasonable legal fees) arising from AI Bizlutions’s breach of this DPA or processing of Personal Data outside of or contrary to the Customer’s documented instructions, to the extent that such breach or unauthorized processing is attributable to AI Bizlutions or its Sub-Processors.
The Customer shall indemnify and hold AI Bizlutions harmless from and against any fines, damages, costs, and expenses arising from the Customer’s breach of its obligations under this DPA, including unlawful instructions or failure to obtain required consents.
AI Bizlutions does not currently maintain a standalone cyber liability insurance policy. AI Bizlutions commits to evaluating and obtaining appropriate technology errors and omissions (E&O) and/or cyber liability insurance coverage commensurate with its processing activities. The Customer acknowledges that AI Bizlutions’s current protection relies on the AWS shared responsibility model, technical security measures, and contractual protections with sub-processors.
AI Bizlutions shall process and retain Personal Data only for the duration necessary to fulfill the purposes described in this DPA and the Agreement.
Stated retention periods represent target enforcement policies that are progressively being automated. Where automated deletion is not yet fully active, data may persist beyond stated periods until manual or automated cleanup is executed. AI Bizlutions will update Customers at https://app.aibizlutions.com/retention-status.html when all retention policies are fully automated.
Upon termination or expiration of the Agreement, AI Bizlutions shall:
Data export shall be provided in machine-readable format (JSON and/or CSV) via the Platform’s data export feature (accessible at Account Settings) or via the API endpoint GET /api/auth/my-data. Export includes all customer-scoped records across all Platform tables. This fulfills the portability requirement of Article 20 GDPR.
Where AI Bizlutions is required by applicable law to retain certain Personal Data beyond the termination date (e.g., billing records for tax purposes), such data shall be isolated, protected, and processed only for the purpose required by law. Retention shall not exceed seven (7) years for financial records.
The thirty (30) day export window in Section 10.2 applies exclusively to Company-initiated termination (e.g., non-payment, breach of terms). When a Customer exercises their Right to Erasure via the in-application self-service deletion mechanism (Settings > Delete Account), deletion is executed immediately upon confirmation. Customers are advised to export their data prior to initiating self-service deletion, as no recovery or grace period applies to user-initiated erasure requests.
This DPA shall remain in effect for the duration of the Agreement. Obligations that by their nature should survive termination (including Sections 2A.9, 5, 6, 7, 9, 10, and 12) shall survive.
This DPA shall be governed by the same governing law specified in the Agreement (State of Arizona, United States). For matters relating to GDPR compliance, the laws of the EU Member State of the applicable supervisory authority shall apply to the extent required by GDPR.
In the event of a conflict between this DPA and the Agreement with respect to data protection matters, this DPA shall prevail. In the event of a conflict between this DPA and the Standard Contractual Clauses, the SCCs shall prevail to the extent required to ensure lawful data transfers.
| Category | Measure |
|---|---|
| Encryption (transit) | TLS 1.2+ on all API endpoints and data transfers |
| Encryption (rest) | AES-256 via AWS KMS for DynamoDB, S3, and credential storage |
| Access control | IAM least-privilege; role-based authorization (admin/agency/client) |
| Authentication | API authentication via customer identifier token validated by server-side Lambda authorizer. Session records maintained with HMAC-signed tokens and 24-hour TTL (auto-expired). Escalating brute-force lockout (5/10/15 failed attempts trigger 15/30/60-minute lockout). |
| Credential storage | OAuth tokens encrypted with AES-256-GCM; secrets in Lambda env vars only |
| PII protection | Automated PII redaction (email, phone, SSN, CC#) before AI transmission |
| Network security | SSRF validation, CORS enforcement, API Gateway request validation, application-layer rate limiting |
| Data minimization | Document content truncated to 10K chars before AI processing; 24-month TTL on AI usage event metadata (no prompt/output content stored) |
| Incident response | 72-hour notification SLA; CloudWatch alerting |
| Business continuity | AWS multi-AZ deployment; automated DynamoDB backups with PITR |
| Personnel | All personnel under confidentiality obligations; access granted on need-to-know basis |
| Vulnerability management | Dependency scanning; no production secrets in version control |
| Physical security | Delegated to AWS; AWS maintains SOC 2 Type II, ISO 27001, physical access controls, biometric entry, 24/7 security staff |
| Security testing | Automated dependency vulnerability scanning on every deployment; manual security review for authentication changes |
| Deletion procedures | Automated cascade deletion via GDPR delete endpoint; S3 object deletion; DynamoDB record removal across all customer-scoped tables |
| Sub-Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, database (DynamoDB), file storage (S3), compute (Lambda) | US-East-2 (Ohio) | AWS DPA, SOC 2 Type II, ISO 27001 |
| Amazon Web Services (SES) | Transactional and campaign email delivery | US-East-1 | AWS DPA, SOC 2 Type II, ISO 27001 |
| Google LLC (Gemini AI) | AI content generation, entity analysis, document processing | United States | Google Cloud DPA, SCCs |
| Stripe, Inc. | Payment processing, subscription management | United States | PCI DSS Level 1, Stripe DPA, SCCs |
| Replicate, Inc. | AI media/video generation | United States | DPA, ephemeral processing (no data retention) |
| Meta Platforms, Inc. | Social media publishing (Facebook/Instagram) — user-initiated only | United States | Meta Platform Terms, SCCs |
| LinkedIn (Microsoft) | Social media publishing — user-initiated only | United States/Ireland | LinkedIn DPA, SCCs |
| Microsoft Corporation | Email sync, calendar integration — user-initiated only | United States/Ireland | Microsoft DPA, SCCs |
| Intuit Inc. (QuickBooks) | Accounting/invoice sync — user-initiated only | United States | Intuit DPA, SOC 2 |
This list was last updated on May 5, 2026. Changes will be communicated with at least 30 days’ advance notice per Section 4.4.
Where required for international data transfers from the EEA/UK/Switzerland to the United States, the parties agree to be bound by the Standard Contractual Clauses (Module 2: Controller to Processor) as set out in the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which are incorporated by reference into this DPA.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs (as issued by the UK Information Commissioner’s Office) is incorporated by reference.
| Role | Data Exporter (Controller) | Data Importer (Processor) |
|---|---|---|
| Name | The Customer (as identified in the Agreement) | AI Bizlutions, LLC |
| Address | As specified in Customer’s account | PO Box 717, Queen Creek, AZ 85142, United States |
| Contact | Customer’s designated account contact | dpo@aibizlutions.com |
| Activities | Controller’s business operations requiring CRM, automation, invoicing, and AI services | Provision of AI Bizlutions Platform as described in the Terms of Service |
| Role | Controller | Processor |
| Element | Description |
|---|---|
| Categories of data subjects | Customer’s employees, clients, contacts, email recipients, invoice recipients (see Section 2.5) |
| Categories of personal data | Contact info, professional info, communications, financial data, usage data, integration data (see Section 2.4) |
| Sensitive data | None intentionally processed. If incidentally included in free-text fields, PII redaction applies before AI processing |
| Frequency of transfer | Continuous, for the duration of the Agreement |
| Nature of processing | Storage, retrieval, AI analysis, email dispatch, integration sync (see Section 2.3) |
| Purpose | Provision of Platform services described in the Terms of Service |
| Retention period | Duration of Agreement plus 30-day export window (see Section 10) |
| Competent supervisory authority | The supervisory authority of the EU Member State in which the data exporter is established |
The technical and organizational measures implemented by the Data Importer are set out in Annex A of this DPA, which is incorporated by reference. Key measures include:
The current list of authorized sub-processors is maintained in Annex B of this DPA, which is incorporated by reference. The Controller has provided general written authorization per Clause 9(a), Option 2.
For transfers subject to the UK GDPR, the UK International Data Transfer Addendum (IDTA) to the EU SCCs is completed as follows:
| Field | Value |
|---|---|
| Start date | The effective date of this DPA |
| Parties | Exporter: The Customer (Controller) / Importer: AI Bizlutions, LLC (Processor) |
| Key contact (Exporter) | As specified in Customer’s account |
| Key contact (Importer) | dpo@aibizlutions.com |
| Field | Value |
|---|---|
| Addendum EU SCCs | The EU SCCs Module 2 (Controller to Processor) as incorporated in this Annex C |
| Module in operation | Module 2 |
| Field | Value |
|---|---|
| Annex 1A (Parties) | As set out in SCC Annex I.A above |
| Annex 1B (Transfer Description) | As set out in SCC Annex I.B above |
| Annex II (TOMs) | As set out in Annex A of this DPA |
| Annex III (Sub-processors) | As set out in Annex B of this DPA |
| Field | Value |
|---|---|
| Importer may end Addendum per Section 19 | Yes — where the Approved Addendum changes in a way that is materially detrimental |
The UK ICO is the competent supervisory authority for UK transfers.
Processor Contact:
AI Bizlutions, LLC
PO Box 717
Queen Creek, AZ 85142
United States
Data Protection Officer: dpo@aibizlutions.com
Legal: support@aibizlutions.com
Security incidents: security@aibizlutions.com
Version 2026-05-05.