Skip to content
Series D: $1B in annualized run rate, new funding, and where Modal goes next. Learn more
Modal Labs, Inc. Data Processing Addendum
Effective October 31, 2025.
This Data Processing Addendum (the "DPA") is incorporated
by reference into the agreement between Modal Labs, Inc. (“Modal”) and Customer (the "Agreement") regarding the Services
described in the Agreement. This DPA is supplemental to the Agreement and
sets out the terms that apply when Personal Data (defined below) is
processed by Modal under the Agreement. Capitalized terms have the
meanings provided in the Agreement except as provided here.
IT IS AGREED AS FOLLOWS:
- Definitions and Interpretation
Unless otherwise defined herein, capitalized terms and expressions used
in this DPA shall have the following meaning:
"Applicable Privacy Law(s)" means all worldwide data
protection and privacy laws and regulations applicable to the Personal
Data in question, including, where applicable:
"EU Data Protection Law”: Regulation 2016/679 of the
European Parliament and of the Council on the protection of natural
persons with regard to the Processing of Personal Data and on the free
movement of such data (General Data Protection Regulation) (“GDPR”) and the EU e-Privacy Directive (Directive 2002/58/EC), each as
implemented and transposed into local law by any EU member states.
"Swiss DPA”: the Swiss Federal Act on Data Protection 1992
(including as amended or superseded).
"UK Data Protection Law”: the UK Data Protection Act and
GDPR as incorporated into UK law by the Data Protection Act 2018 and amended
by the Data Protection, Privacy and Electronic Communications (Amendments
etc) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced).
"US Data Protection Law”: all applicable
comprehensive state Applicable Privacy Laws and regulations in each
case as may be amended or superseded from time to time, including the
California Privacy Rights Act ("CPRA"); Colorado
Privacy Act; Connecticut Personal Data Privacy and Online Monitoring
Act; Delaware Personal Data Privacy Act; Indiana Consumer Data
Protection Act; Iowa Consumer Data Protection Act; Montana Consumer
Data Privacy Act; Oregon Consumer Privacy Act; Tennessee Information
Protection Act; Texas Data Privacy and Security Act; Utah Consumer
Privacy Act; Virginia Consumer Data Protection Act.
"Customer Personal Data" means any Personal Data
Processed by a Subprocessor on behalf of Customer pursuant to or in
connection with the Agreement;
"Data Breach" means a breach of security leading to the
accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to, Customer Personal Data.
"Controller", "Data Subject", "Process" (whether or not capitalized), "Processor”, and "Subprocessor" have the meanings ascribed to them by GDPR and include equivalent
terms in California Data Protection Law, in each case as applicable to
the Services.
"EEA" means the European Economic Area;
"Standard Contractual Clauses" or "SCCs" means: (a) where EU Data Protection Law or the Swiss DPA applies, the
contractual clauses annexed to the European Commission’s Implementing
Decision 2021/914 of 4 June 2021 on standard contractual clauses for the
transfer of Personal Data to third countries pursuant to Regulation (EU)
2016/679 of the European Parliament and of the Council ("EU SCCs"); and (b) where UK Data Protection Law applies, standard data