2(a) Security standards.

• •Encryption at rest using AES-256 encryption for all stored data
• •Encryption in transit using TLS 1.3 or higher for all data transmissions
• •Multi-factor authentication required for all administrative access
• •Regular security audits conducted by independent third-party security firms
• •SOC 2 Type I compliance with annual attestation updates (Type II in progress)
• •ISO/IEC 42001:2023 AI-Management-System controls applied across the model lifecycle

2(b) Access controls.

• •Role-based access control with minimum-necessary permissions
• •Regular access reviews and timely deprovisioning procedures
• •Background checks for personnel with access to Customer Data
• •Secure development practices, including code reviews and automated vulnerability scanning
• •Annual security awareness training for all employees and contractors with system access

3(a) Incident detection and classification.

365Agents maintains 24×7 security monitoring to detect: unauthorized access to Customer Data or systems; data exfiltration attempts or successful breaches; system vulnerabilities that could compromise security; malware or ransomware incidents; and insider threats or suspicious employee activity.

3(b) Immediate response (0–4 hours).

Upon detecting a potential security incident: incident response team activation within 1 hour of detection; preliminary assessment of scope and severity; containment measures to prevent further unauthorized access; evidence preservation for forensic analysis; and initial documentation of incident timeline and affected systems.

3(c) Investigation phase (4–72 hours).

Incident response includes: forensic analysis to determine root cause and scope; assessment of data types and volume of information potentially compromised; identification of affected customers and data subjects; documentation of unauthorized access methods and duration; and coordination with law enforcement if criminal activity is suspected.

4(a) Notification timeline.

• •Without unreasonable delay and no later than 72 hours after confirming a Personal Data breach (consistent with GDPR requirements)
• •Immediately, by reasonable means available, if ongoing risk requires urgent customer action (target: within 24 hours of confirmation)
• •As required by applicable law in Customer's jurisdiction

4(b) Notification content.

Breach notifications will include: description of the incident, including date, time, and duration; types of data involved and estimated number of affected records; likely consequences of the breach for affected individuals; measures taken to address the breach and prevent recurrence; contact information for questions and additional details; and recommendations for Customers to protect affected individuals.

4(c) Regulatory notifications.

365Agents will handle required notifications to: data protection authorities within 72 hours when required; law enforcement agencies when criminal activity is involved; other regulatory bodies as required by applicable law; and credit-monitoring services when financial data is involved.

5(a) Backup and recovery.

• •Automated daily backups with geographically distributed storage
• •Point-in-time recovery capabilities for database restoration
• •Disaster recovery sites with maximum 4-hour RTO and 24-hour RPO
• •Regular backup testing and restoration procedures
• •Business continuity planning with defined escalation procedures

6(a) Incident analysis.

After resolution, 365Agents conducts: root cause analysis to identify failure points; security control assessment and enhancement recommendations; process improvement review for incident response procedures; documentation update for policies and procedures; and staff training updates based on incident findings.

6(b) Ongoing monitoring.

Enhanced security measures include: increased monitoring of affected systems for 90 days; additional security controls implementation as appropriate; regular vulnerability assessments and penetration testing (annually at minimum); and third-party security reviews for affected components.

7(a) Legal basis for processing.

365Agents processes Personal Data under the following legal bases: contract performance for providing services requested by customers; legitimate interests for improving services and preventing fraud; consent where specifically obtained for marketing or optional features; and legal obligations for compliance with applicable laws and regulations.

7(b) Data subject rights.

Under GDPR, individuals have the right to: access their Personal Data and obtain a copy; rectification of inaccurate or incomplete Personal Data; erasure ("right to be forgotten") under specific circumstances; restriction of processing in certain situations; data portability in machine-readable format; object to processing based on legitimate interests; and withdraw consent where processing is based on consent.

7(c) Data Protection Impact Assessments (DPIAs).

365Agents conducts DPIAs for: high-risk processing activities involving Personal Data; new AI model training using customer voice data; system changes that may affect data protection; and cross-border data transfers to new jurisdictions.

9(a) Consumer rights under CCPA.

California residents have the right to: know what Personal Information is collected and how it is used; delete Personal Information held by businesses; opt out of "sale" or "sharing" of Personal Information; non-discrimination for exercising CCPA rights; and access specific pieces of Personal Information.

9(b) CCPA disclosures.

365Agents provides: annual privacy policy updates with required CCPA disclosures; a consumer request portal for exercising CCPA rights (https://365agents.com/privacy-requests); verification procedures for identity confirmation; and response timelines of 45 days, with possible 45-day extension as permitted.

9(c) State-law equivalents.

365Agents extends comparable rights to consumers in states with substantially similar privacy laws (including VCDPA, CPA, CTDPA, UCPA, and other applicable state laws), as required.

10(a) Transfer mechanisms.

For international data transfers, 365Agents uses: Standard Contractual Clauses approved by the European Commission; adequacy decisions where available for specific countries; Binding Corporate Rules for intra-group transfers; and certification schemes where recognized by data protection authorities.

10(b) Country-specific restrictions.

Data transfers are restricted or prohibited to: countries under sanctions by the U.S., EU, or other applicable jurisdictions; and jurisdictions without adequate protection unless appropriate safeguards are in place.