Metrum AI Bench Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement for Metrum AI Bench (the “Agreement”) between the customer identified in the Agreement (“Customer”) and Metrum AI, Inc., 1717 N I-35, Suite 300, Round Rock, Texas 78664, United States (“Metrum AI”). It applies when Metrum AI processes Customer Personal Data on Customer’s behalf.

1. Definitions

Terms used in this DPA have the following meanings. Other capitalized terms have the meaning given in the Agreement or in Data Protection Laws.

Customer Content means the workloads, datasets, prompts, model and endpoint responses, judge outputs, endpoints, machine registrations, run configurations, performance results, run results, and run logs that Customer and its users put into or produce in the Service, as the Privacy Policy describes.

Customer Personal Data means personal data in Customer Content. It does not include the account, billing, security, and service operations data for which Metrum AI is an independent controller.

GDPR means Regulation (EU) 2016/679, and UK GDPR means the GDPR as it forms part of the law of the United Kingdom.

Privacy Policy means the Metrum AI Bench Privacy Policy published in the Service.

Service means the Metrum AI Bench platform, the Metrum agent, and its command-line tools.

Standard Contractual Clauses means the clauses in Commission Implementing Decision (EU) 2021/914, as Section 12 applies them.

Data Protection Laws means all privacy and data protection laws that apply to the processing, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, applicable UAE, DIFC and ADGM data protection laws, and applicable US state privacy laws such as the California Consumer Privacy Act.

Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

Sub-processor means a third party that Metrum AI engages to process Customer Personal Data.

2. Roles and scope

Customer is the controller of Customer Personal Data, and Metrum AI is its processor. Where Customer is itself a processor, Metrum AI acts as Customer’s sub-processor. Metrum AI is an independent controller of account, billing, security, and service operations data, as its Privacy Policy describes.

Annex I describes the processing. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

3. Customer instructions

Metrum AI processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s use and configuration of the Service are Customer’s complete instructions.

Metrum AI tells Customer promptly if it believes an instruction violates Data Protection Laws. If a law requires Metrum AI to process Customer Personal Data in another way, Metrum AI tells Customer first, unless that law forbids it.

4. Confidentiality

Metrum AI ensures that every person it authorizes to process Customer Personal Data is bound by a duty of confidentiality and has access only as far as their role requires.

5. Security

Metrum AI implements and maintains the technical and organizational measures in Annex II. Metrum AI may update those measures, provided that an update does not reduce the overall level of protection.

6. Sub-processors

1. Customer gives general authorization for Metrum AI to engage the Sub-processors listed in Annex III.
2. Metrum AI gives Customer at least 30 days’ notice by email before it adds or replaces a Sub-processor.
3. Customer can object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer can terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
4. Metrum AI imposes data protection terms on each Sub-processor that protect Customer Personal Data at least as well as this DPA, requires each Sub-processor to process Customer Personal Data only for the contracted services, and prohibits each Sub-processor from using Customer Personal Data to train or fine-tune models for its own purposes unless Customer expressly agrees otherwise in writing. Metrum AI remains responsible for each Sub-processor’s performance.

Providers that Customer selects itself are not Sub-processors. These include cloud accounts that Customer connects to the Service and model endpoints or judge models that Customer adds. Those providers act on Customer’s instructions under Customer’s own agreements with them.

7. Requests from individuals

Metrum AI tells Customer within 5 business days if it receives a request from an individual about Customer Personal Data and does not answer it unless Customer tells it to. Metrum AI helps Customer respond to such requests, taking into account the nature of the processing.

8. Assistance

Metrum AI gives Customer reasonable help with data protection impact assessments and with consultations with supervisory authorities, where they relate to the Service and Customer does not have the information itself.

9. Security Incidents

Metrum AI notifies Customer without undue delay, and in any case within 48 hours, after it becomes aware of a Security Incident that affects Customer Personal Data. The notice describes the incident, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed. Where Metrum AI cannot give all of this at once, it gives it in stages without undue delay. Notice of a Security Incident is not an admission of fault.

10. Deletion and return

When the Agreement ends, Customer can choose to have Customer Personal Data returned or deleted. If Customer asks for a return within 30 days after the Agreement ends, Metrum AI exports Customer Content in a machine-readable format.

Metrum AI deletes Customer Personal Data within 60 days after the Agreement ends unless a law requires it to keep some of it. Deleted data remains in encrypted backups for up to 35 days, until those backups expire. On request, Metrum AI confirms the deletion in writing.

11. Audits

Metrum AI makes available the information Customer needs to show compliance with Article 28 of the GDPR. This includes written answers to a reasonable security questionnaire once a year and any independent security reports Metrum AI holds.

If that information is not enough, or a supervisory authority requires it, Customer can audit Metrum AI once a year, with 30 days’ notice, during business hours, at Customer’s cost, and under a confidentiality agreement. Customer can use an independent auditor that is not a competitor of Metrum AI.

12. International transfers

Metrum AI processes Customer Personal Data in the United States. Metrum AI staff in the United States and India can access it to operate and support the Service, and cloud machines process it in the region Customer selects for each run. Where Data Protection Laws require a transfer mechanism, the following terms apply and are incorporated into this DPA:

Where a Sub-processor is certified under the EU-US Data Privacy Framework or its UK and Swiss extensions, Metrum AI may rely on that certification for onward transfers. Metrum AI keeps the Standard Contractual Clauses available as a fallback where appropriate.

13. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, Metrum AI acts as Customer’s service provider or processor. Metrum AI does not sell or share Customer Personal Data, does not retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, and does not combine it with personal data from other sources except as that law permits.

Metrum AI gives Customer Personal Data the level of privacy protection required by applicable law. Customer may take reasonable and appropriate steps to ensure that Metrum AI uses Customer Personal Data consistently with those requirements and to stop and remediate unauthorized use. Metrum AI helps Customer respond to consumer requests as Section 7 describes and tells Customer if it can no longer meet these obligations.

14. Restricted uses of Customer Content

Metrum AI does not use Customer Content, including performance results or run configurations, for public Metrum AI leaderboards, published benchmarks, marketing, or public performance comparisons.

Metrum AI does not use Customer Content to train or fine-tune AI models unless Customer expressly agrees otherwise in writing.

Metrum AI requires its Sub-processors to process Customer Content only for the contracted services and prohibits them from using Customer Content to train or fine-tune models for their own purposes unless Customer expressly agrees otherwise in writing.

Metrum AI may process Service telemetry that is separate from Customer Content, such as usage counts required for billing, error rates, and availability information, to operate, secure, and support the Service.

15. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws do not allow such a limitation. This DPA lasts as long as Metrum AI processes Customer Personal Data.

Annex I. Description of the processing

A. Parties

B. Processing details

Annex II. Technical and organizational measures

Metrum AI maintains the following measures.

Annex III. Sub-processors

Stripe, Inc. processes billing data as an independent controller for fraud prevention and compliance and as Metrum AI’s processor for payments. Billing data is Metrum AI controller data, not Customer Personal Data, so Stripe is not listed as a Sub-processor for Customer Personal Data in this Annex.

Signatures