Terms of service

Updated 07 October 2026

These Terms of Service (the “Terms”) including its appendices listed below constitute the entire agreement between the Customer or You and Windsor Group AG (”Windsor.ai” or “we,” “our” or “us”), regarding your use of our services specified in the Terms (the software, and services are collectively referred to as the “Service”). Please read these Terms carefully. The term “you” shall also include your employees or other authorized users to the extent applicable and permitted under your subscription to the Service.

The following appendices form an inseparable part of and are governed by the terms of these Terms of Service:

Annex 1: Data Processing Agreement

In the event of any conflicting terms in the Terms and its appendices, the Terms shall take precedence over the appendices, except in any matters relating to the processing of personal data, in which case Annex 1 (Data Processing Agreement) shall take precedence.

1. The Service

The Service is an analytics and reporting solution that helps customers collect their online data and create reports.

2. Eligibility

The Service is not intended for users who are consumers (being an individual acting primarily for purposes other than a trade, business, or profession) and the applicability of consumer protection legislation is therefore excluded. You must be 18 years of age or older to enter into this agreement and use the Service. You represent and warrant that any information you submit is true and accurate and that you are 18 years of age or older and are fully able and competent to enter into, and abide by these Terms.

3. Account Registration

You must register to use certain features of the Service. When you register, you agree to (a) provide accurate, current and complete information about you as may be prompted by registration forms on the Service (“Registration Data”); (b) maintain the security of any logins, passwords, or other credentials that you select or that are provided to you for use on the Service; (c) maintain and promptly update the Registration Data, and any other information you provide to us, and to keep all such information accurate, current, and complete; and (d) notify us immediately of any unauthorized use of your account or any other breach of security by emailing us at [email protected].

4. Free Trial

We may, at our sole discretion, offer you free trials for selected features of the Service or a limited-time trial period of the entire Service. Once your free trial period ends, your ability to access the Service will terminate. Windsor.ai reserves the right to determine if you are eligible for a free trial and to discontinue any free trial without notice at our sole discretion.

5. Fees and payment

Access to selected features of the Service may be provided to you free of charge. We will charge fees for certain features, either on a one-time or a subscription basis (“Paid Services”). Windsor.ai reserves the right to implement fees or change the fees for certain services at any time by providing you with notice on the Service or otherwise. When you purchase any Paid Services, you authorize Windsor.ai or its third-party payment processors to charge the credit card identified by you (which you represent and warrant that you are authorized to use) all applicable fees for your purchase, including all applicable taxes, and you agree that our payment provider can store your credit card information. If Windsor.ai does not receive payment from your credit card provider, you agree to pay all amounts due upon demand, and Windsor.ai may suspend your access to the Services until full payment is received or terminate the Terms of Service. All sales are final, and Windsor.ai will not issue refunds, including for prepaid monthly fees. If you choose an automatic recurring payment and later decide to end your subscription, cancelling the payment is your responsibility. Windsor.ai does not refund automatic payments not cancelled in time.

6. Use Restrictions

Your right to use the Service is personal, limited to your internal business purposes, non-transferable, non-exclusive, revocable, and subject to your compliance with the Terms at all times, including your timely payment of all applicable fees for the Services.

Licenses for the Service are based on the Service client, data source, data destination, and usage restrictions. Licenses may be restricted to one individual, company, your Windsor.ai team, or specific data access/usage. For example, Windsor.ai for Google Sheets and Windsor.ai for Excel licenses are restricted to a single user, and Windsor.ai for Looker Studio license is restricted to groups of individuals in a single Windsor.ai Team account (see https://team.windsor.ai). There may be additional restrictions on purchased licenses, and restrictions may change from time to time. We will take every step to inform you of impending changes in a timely manner. Special license usage terms and/or restrictions may be entered into with Windsor.ai through a separate agreement and/or contract that will override these Terms.

Without limiting the generality of the foregoing, you will not:

access, monitor, or copy any content or information on the Service using any robot, spider, scraper, or other automated means or any manual process for any purpose without our express written permission;
violate the restrictions in any robot exclusion headers on the Service or bypass or circumvent other measures employed to prevent or limit access to the Service;
take any action that imposes, or may impose, in our discretion, an unreasonable or disproportionately large load on our infrastructure;
deep-link to any portion of the Service for any purpose without our express written permission;
“frame”, “mirror,” or otherwise incorporate any part of the Service into any other website without our prior written authorization; or
violate any applicable local, provincial, national, or international law or regulation.

We may at any time suspend or terminate your access to the Service if we have reason to believe that you are not complying with the Terms or you are otherwise abusing the Service.

7. Third-party services, data, and content

7.1 The Service allows you to gather data from multiple third-party data sources and services, including various third-party websites (jointly “Third-Party Services”). The Third-party Services from which the data can be gathered are selected by Windsor.ai at its sole discretion. Windsor.ai may, after the conclusion of the Terms, change such available sources in accordance with Section 8. Notwithstanding the above, Windsor.ai may always discontinue Third-Party Services if the service providers of the Third-Party Services in question discontinue the relevant services or discontinue providing such services to Windsor.ai.

7.2 Windsor.ai assumes no liability whatsoever for the data or other content collected from Third-Party Services. You are solely responsible for ascertaining that you have the right to use the Service for gathering and processing any such data by using the Service, and you must obtain any such consents and authorizations as may be needed from time to time in relation to such data or other content and their processing by using the Service. The Service may be used as an add-on to various Third-Party Services and software. We do not assume any liability for such Third-Party services or software, and you are exclusively responsible for obtaining any necessary licenses or consents needed for their use. You must familiarize yourself with the applicable terms and conditions, including any restrictions on use, in relation to any such Third-Party Services, and you agree to comply with such third-party terms and conditions in addition to the terms of these Terms.

7.3 Furthermore, the Service may contain links to Web pages and content of third parties as a service to those interested in this information. We do not monitor, endorse, adopt, or have any control over any third-party content. We undertake no responsibility to update or review any third-party content and can make no guarantee as to its accuracy or completeness. Additionally, if you follow a link or otherwise navigate away from the Service, please be aware that these Terms will no longer govern. You should review the applicable terms and policies, including privacy and data gathering practices, of any third-party content or service provider to which you navigate from the Service. You access and use third-party content at your own risk. The Service may contain advertisements and promotions from third parties. Your business dealings or correspondence with, or participation in promotions of, advertisers other than us, and any terms, conditions, warranties, or representations associated with such dealings, are solely between you and such third party.

7.4 With Google services, our tools will only have rights to access your Google Analytics/AdWords/YouTube data (depending on which service you are logging in to), nothing else on your Google account. You can revoke Windsor.ai’s right to access your data at any point from your Google account control panel (https://security.google.com/settings/security/permissions). For your reference, you should view the Terms of Service for YouTube (https://www.youtube.com/static?template=terms), and Google Analytics (https://www.google.com/analytics/terms/us.html), as well as Google’s Privacy Policy (https://policies.google.com/privacy), as you will be bound to these terms when you connect and fetch your data from these services.

8. Modifications to the Service

Windsor.ai reserves the right to modify, discontinue, and restrict, temporarily or permanently, all or part of the Service without notice at our sole discretion. Neither we nor our suppliers or licensors will be liable to you or to any third party for any modification, discontinuance, or restriction of the Service.

9. Subcontractors

Windsor.ai may engage subcontractors to perform the Service under the Terms. Windsor.ai remains responsible for the performance of its subcontractors under the Terms, except that Windsor.ai shall not be liable for the acts or omissions of its hosting or data communication service providers other than as required by Data Privacy Laws (as defined in Annex 1) or as set out in Annex 1.

10. Term and Termination

10.1 Your account and subscription to the Service remain in effect unless you terminate it or unless Windsor.ai terminates your account as provided by these Terms. Your account and subscription to the Service may, depending on your choice, be automatically renewable or valid for a fixed period.

Terms of Service regarding Paid Services enter into force when we have received payment from your credit card provider. If the Service is provided to you free of charge, the Terms of Service enter into force upon your trial license creation and/or account registration.

If your subscription is automatically renewable, your subscription to the Service will remain in effect and will be renewed automatically at the end of each subscription period unless you terminate your subscription or we terminate it.

If your subscription is made for a fixed period and/or is not automatically renewable, your subscription will automatically terminate at the end of the agreed subscription period.

Separate written order forms or contracts for the Service may have special adherence terms regarding renewal and defined advance notice periods for termination.

Upon the termination or expiration of your subscription, you must immediately stop using the Service and must destroy any copies of the same in your possession.

10.2 If Customer’s continued use of the Service may result in material harm to Windsor.ai, its subcontractors, affiliates, or another customer of the Service, Windsor.ai may block or restrict Customer’s access to the Service, always provided that Windsor.ai does not adopt or undertake more far-reaching measures than are justified under the circumstances.

10.3 In addition, Windsor.ai is entitled to suspend an individual user’s continued use of the Service if the individual user has submitted information to the Service in breach of applicable legislation or otherwise used the Service in breach of the Terms.

11. Feedback

Any materials, including but not limited to comments, suggestions, ideas, or other information, provided by you in the form of email or other submissions to us (excluding Customer Data and other material that you post on the Service in accordance with these Terms) (collectively “Feedback”), are non-confidential and you hereby grant to us and our subcontractors and affiliates a nonexclusive, royalty-free, perpetual, irrevocable, and fully sublicensable right to use your Feedback for any purpose without compensation or attribution to you.

12. Trademarks

12.1 Windsor.ai, the Windsor.ai logos, and any other product or service name or slogan contained on the Service are trademarks or registered trademarks of Windsor.ai and its suppliers or licensors, and may not be copied, imitated, or used, in whole or in part, without the prior written permission of the applicable trademark holder. All other trademarks, registered trademarks, product names and company names, or logos mentioned on the Service are the property of their respective owners. Reference to any products, services, processes, or other information, by trade name, trademark, manufacturer, supplier, or otherwise, does not constitute or imply endorsement, sponsorship, or recommendation thereof by us, or vice versa.

12.2 Unless You provide us with written notice to the contrary or of any reasonable restrictions or requirements, you agree that Windsor.ai may use your name(s) and logo(s) in the Windsor.ai website, press releases, promotional and sales literature, customer/prospect presentations, lists of customers, and/or other similar situations in accordance with good marketing practices.

13. Ownership and intellectual property rights

13.1 We, our affiliates, and our suppliers and licensors own all right, title, and interest, including all intellectual property rights, in and to the Service, and any services available in connection with the Service. Except for those rights expressly granted in these Terms, no other rights are granted, either express or implied, to you. All copying, distribution, or other use of the Service or any third-party services or content except as expressly permitted hereunder is prohibited without the prior written consent of the relevant rights holders.

13.2 Windsor.ai will defend, indemnify and hold harmless Customer, its representatives, subsidiaries, affiliates and customers from and against any costs, damages, expenses, and liabilities (including, but not limited to, reasonable attorneys’ fees) arising out of or in relation to any claims or actions regarding infringement of a third party’s intellectual property rights due to Customer’s use of the Service. The obligation by Windsor.ai only applies under the condition that the Customer has notified Windsor.ai in writing of a claim or action within a reasonable time. In case such a third-party claim is made or is likely to be made, Windsor.ai is responsible, at its own cost, for obtaining any necessary rights for the Customer to continue to use the Service under the Terms of Service or replacing or modifying the infringing part of the Service to be non-infringing without decreasing functionality. If all Services provided under the Terms are affected and terminated, the Terms shall be considered terminated in their entirety.

13.3 Windsor.ai liability for infringement of intellectual property rights in the Service shall be limited to section 13.2.

14. Confidential information

If we share non-public information about the Service with you, you must keep it confidential and use reasonable security measures to prevent unauthorized disclosure of or access to that information.

15. Privacy Policy and processing of data

15.1 Windsor.ai will process personal data as both 1) a data controller (or, under US State Privacy Laws as defined in Annex 1, a business) and 2) a data processor (or, under US State Privacy Laws, a service provider or processor).

15.2 As a data controller, we process personal data about you when you sign up for the Service or when you otherwise provide personal information to us in the context of these Terms. Our collection and use of this information, which we process as the data controller, is described in the Privacy Policy, available at windsor.ai/privacy-statement/.

15.3 As a data processor, we process such personal data which you have provided to us (including collected or generated through the use of the Service) for the purpose of providing the Service. This processing of personal data is governed by the Data Processing Agreement (Annex 1) entered into between you and us in connection with your signing up for the Service. Annex 1 applies to all personal data processed by Windsor.ai on behalf of the Customer, regardless of where the Customer or the data subjects are located.

16. Customer Data

16.1 Customer, its subsidiaries, affiliates, and customers retain all rights pertaining to all data, personal data, or other information that Customer, or another party on Customer’s behalf, provides to Windsor.ai for the purpose of providing the Service (“Customer Data”). For the avoidance of doubt, Customer Data is considered Confidential Information.

16.2 You will defend, indemnify and hold harmless Windsor.ai, its subsidiaries, affiliates, partners and third-party advertisers and their respective directors, officers, agents, employees, licensors, and suppliers from and against any costs, damages, expenses, and liabilities (including, but not limited to, reasonable attorneys’ fees) arising out of any claims or actions by any third party that relates to an actual or alleged infringement of a third party’s intellectual property rights by the Customer Data.

17. Disclaimer of Warranties

Your use of the service, including, without limitation, your use of any content accessible through the service and your interactions and dealings with any service users, is at your sole risk. Windsor.ai does not warrant uninterrupted use or operation of the service or your access to any content. No advice or information, whether oral or written, obtained by you from the service will create any warranty regarding Windsor.ai that is not expressly stated in these Terms.

However, Windsor.ai warrants that it will perform its obligations in a professional manner, and the Service shall be performed in accordance with the methods normally applied by a well-reputed service provider.

18. Limitation of Liability

Neither party nor its suppliers or licensors will be liable for any indirect, incidental, special, consequential, or exemplary damages, including, without limitation, damages for loss of profits, goodwill, use, data, or other intangible losses (even if Windsor.ai or any supplier or licensor has been advised of the possibility of these damages), arising out of or relating to your access to or use of, or your inability to access or use the Service or any content. Windsor.ai’s maximum total liability towards the other party and its suppliers and licensors for all claims under these Terms or otherwise in relation to the Service, whether in contract, tort, or otherwise, is limited to 100 EUR.

Any limitations of liability under this Section 18 shall not apply in the event of death, personal injury, damage to third-party property, liability in accordance with Section 14 (Confidentiality), or in the event of willful conduct or gross negligence.

19. Consent to Electronic Communications

By using the Service, you consent to receiving electronic communications from us. These communications may include notices about your account and information concerning or related to the Service.

20. Governing law and dispute resolution

These Terms shall be governed and construed in accordance with the laws of Switzerland, without giving effect to principles of conflicts of law or to the Convention on Contracts for the International Sale of Goods. Any dispute, controversy, or claim arising out of or relating to this contract, or the breach, termination, or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Swiss Chamber of Commerce. The seat of arbitration shall be Zurich, Switzerland. The number of arbitrators shall be one. The language of the arbitration shall be English.

21. Communications and Newsletters

By registering for or using the Service, you consent to receive emails from Windsor.ai regarding your account and your use of the Service. These communications may include:

Onboarding instructions and guidance to help you get started with the Service
Updates about new features, improvements, or changes to the Service
Newsletters and announcements containing product-related information
Important service notifications

These communications are intended to ensure you have a complete and successful experience with the Service. You may unsubscribe from these communications at any time by following the instructions included in each email.

22. Other terms

Our failure to act in a particular circumstance does not waive our ability to act with respect to that circumstance or similar circumstances. Any provision of these Terms that is found to be invalid, unlawful, or unenforceable will be severed from these Terms, and the remaining provisions of these Terms will continue to be in full force and effect. The section headings and titles in these Terms are for convenience only and have no legal or contractual effect. Any provision in these Terms that by its nature should survive the termination of your license to access the Service or any termination of these Terms (including, without limitation, provisions governing indemnification, limitations on liability, disclaimers of warranty, and ownership of intellectual property) will continue to remain in full force and effect after any such termination. Windsor.ai may change the content of these Terms, subject to posting a notice of change on its web page.

23. Questions and Contact Information

If you have any questions or concerns about the Service or these Terms, you may contact Windsor.ai at [email protected].

ANNEX 1 Data Processing Agreement

1. Definitions

1.1 “Agreement” means the Terms of Service, including this DPA, together with any order form or separate written contract between the Customer and Windsor.ai for the Service.

1.2 “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with its implementing regulations.

1.3 “Data Privacy Laws” means all laws and regulations applicable to the processing of Personal Data under this DPA, including, to the extent applicable, the GDPR, the UK GDPR, the FADP and US State Privacy Laws, each as amended or superseded from time to time.

1.4 “Data Subject” means an identified or identifiable natural person to whom Personal Data relates, and includes a “consumer” as defined in US State Privacy Laws.

1.5 “EU Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, or any subsequent final version thereof.

1.6 “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances.

1.7 “GDPR” means the General Data Protection Regulation (EU) 2016/679.

1.8 “Personal Data” means any information relating to a Data Subject that is protected under Data Privacy Laws and that is provided to Windsor.ai by or on behalf of the Customer, or collected or generated through the Customer’s use of the Service, and includes “personal information” as defined in US State Privacy Laws.

1.9 “Sub-processor” means any third party engaged by Windsor.ai to process Personal Data on behalf of the Customer.

1.10 “UK Addendum” means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

1.11 “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

1.12 “US State Privacy Laws” means the CCPA and any other United States state law of general application governing the processing of personal information that applies to Personal Data processed under this DPA, together with implementing regulations, each as amended or superseded from time to time.

1.13 Terms such as “controller”, “processor”, “processing”, “personal data breach” and “supervisory authority” that are used but not defined in this DPA have the meaning given to them in Article 4 of the GDPR. Equivalent terms under the FADP, the UK GDPR and US State Privacy Laws shall be interpreted accordingly. In particular, under US State Privacy Laws, “controller” includes a “business”, “processor” includes a “service provider” or “contractor”, “personal data breach” includes a “breach of security”, and “supervisory authority” includes the relevant state attorney general or state privacy agency.

2. Applicability, nature and purpose of the processing

2.1 This Data Processing Agreement (“DPA”) is an annex to and forms an inseparable part of the Terms of Service between the Customer or you and Windsor.ai, regarding your use of our Services.

2.2 The agreed Service delivery may include processing of Personal Data by Windsor.ai and its Sub-processors, on behalf of the Customer, within the scope described in the Agreement. The purpose of this DPA is to set the terms and conditions governing such processing by Windsor.ai on behalf of the Customer in compliance with Data Privacy Laws.

2.3 Windsor.ai may process Personal Data solely to the extent necessary for the provision of the Services set forth in the Agreement, and may not otherwise process or use Personal Data for purposes other than those set forth in this DPA or as reasonably instructed by the Customer in writing where such instructions are consistent with the terms of the Agreement. This DPA shall take precedence over conflicting provisions relating to the processing of Personal Data in the Agreement, unless otherwise expressly stated in this DPA or in an order form or other written contract signed by both parties that expressly refers to and amends this DPA.

2.4 The parties acknowledge and agree that the Customer enters into this DPA on behalf of itself and on behalf of its affiliates, which utilize the Services as defined in the Terms of Service (“Affiliates”), thereby establishing a separate DPA between Windsor.ai and each of the Customer Affiliates, subject to the terms of this DPA. The Customer and Affiliates are jointly referred to as the “Customer”. Windsor.ai enters into this DPA on its own behalf and on behalf of those of Windsor.ai’s group companies that are involved in the processing of Personal Data under this DPA and the Terms of Service.

2.5 Where the Service is delivered using cloud infrastructure of a third-party provider (Amazon Web Services, Microsoft, Google or other), such provider acts as a Sub-processor. The technical and organizational measures applied within the cloud environment include those made available by the cloud provider under its then-current terms, together with the measures implemented by Windsor.ai under Section 7.2. Windsor.ai remains responsible for such cloud provider in accordance with Section 8.5, subject to the limitations of liability in Section 14.

3. Term and termination of this DPA

3.1 This DPA shall become effective simultaneously with the Terms of Service and shall remain in force during the validity of the Terms of Service and thereafter for as long as necessary for the finalization of the agreed processing of Personal Data.

4. Processing of Personal Data

4.1 Roles. For the sake of clarity, it is noted that in relation to the Personal Data processed under this DPA, Windsor.ai acts as a processor or second processor (a so-called sub-processor) and the Customer acts as a controller or first processor (to the extent Windsor.ai processes Personal Data for which a customer of the Customer is considered controller). Where US State Privacy Laws apply, Windsor.ai acts as a service provider or processor and the Customer acts as a business or controller, as further set out in Section 12.

4.2 Categories of Data Subjects. As determined by the Customer through its use of the Service, the Personal Data will concern the following categories of Data Subjects:

(a) Data Subjects about whom Windsor.ai collects Personal Data in its provision of the Services; and/or

(b) Data Subjects about whom Personal Data is transferred (including granted access to) to Windsor.ai in connection with the Services by, at the direction of, or on behalf of the Customer.

These Data Subjects may include individuals: (i) to whom online advertising has been, or will be, directed; (ii) who have visited websites, platforms, services or applications in respect of which Windsor.ai provides the Services; and/or (iii) who are customers or users (including prospective customers or users) of the Customer or the Customer’s customers.

4.3 Types of Personal Data. As determined by the Customer through its use of the Service, the Personal Data may include:

(a) online identifiers, such as cookie identifiers, internet protocol addresses, and device identifiers; precise location data; client identifiers;

(b) contact details, such as names, email addresses, phone numbers, and addresses;

(c) data relating to individuals provided to Windsor.ai via the Services by (or at the direction of) the Customer, including to create and collaborate on reports, graphs, and charts;

(d) event data and CRM data relating to individuals provided to Windsor.ai via the Services by (or at the direction of) the Customer, such as data about Data Subjects and the actions they take on or in relation to specific websites, apps, services, or applications;

(e) financial and transactional details such as accounting, sales, orders, invoices, payments, and items purchased; and

(f) other Personal Data submitted to the Services by (or at the direction of) the Customer within the scope of the Agreement.

4.4 Nature, purpose and duration of the processing. The processing activities performed by Windsor.ai typically consist of:

(a) collection of data from Third-Party Services via APIs or similar interfaces, as instructed by the Customer through its configuration of the Service;

(b) secure transmission of such data from the source systems to the destinations designated by the Customer, such as Customer-controlled data warehouses, spreadsheets, business intelligence tools, AI assistants or other Third-Party Services;

(c) temporary caching of data to the extent necessary for the efficient operation of the Service, with encryption at rest;

(d) storage of data where the Customer elects to use a destination hosted by Windsor.ai, for the duration determined by the Customer and subject to Section 10;

(e) transformation of data as instructed by the Customer, including aggregation, formatting, blending, currency conversion, reporting and similar operations required to deliver the Service;

(f) access to data for customer support purposes, limited to what is necessary to investigate, diagnose and resolve support requests; and

(g) deletion of data, including automated deletion of cached data in accordance with Windsor.ai’s retention policy and deletion upon termination of the Service or earlier on the Customer’s instruction.

The specific business purposes for which Windsor.ai processes Personal Data are: (i) providing, maintaining and securing the Service; (ii) providing customer support; (iii) detecting and preventing security incidents, fraud and illegal activity; and (iv) complying with legal obligations, in each case by means of the processing activities described in (a) to (g) above. Windsor.ai processes Personal Data for the term of the Agreement and thereafter only for the period necessary to return or delete the Personal Data in accordance with Section 10.

4.5 Special categories of Personal Data. The Service is not designed for the processing of special categories of personal data within the meaning of Article 9 of the GDPR, sensitive personal data within the meaning of the FADP, or sensitive data or sensitive personal information within the meaning of US State Privacy Laws. The Customer shall not submit such data to the Service unless expressly agreed with Windsor.ai in writing.

4.6 Customer instructions. This DPA, the Agreement and the Customer’s configuration and use of the Service constitute the Customer’s complete and documented instructions for the processing of Personal Data. Windsor.ai shall not process Personal Data for any other purpose or otherwise deviate from these instructions, unless required to do so by law to which Windsor.ai is subject, in which case Windsor.ai shall, to the extent legally permitted, inform the Customer of that legal requirement before processing. If Windsor.ai considers that an instruction infringes Data Privacy Laws, or that it lacks instructions necessary to perform the processing in accordance with this DPA or Data Privacy Laws, Windsor.ai shall promptly inform the Customer and may suspend the processing concerned until the Customer has confirmed or amended the instruction.

5. Responsibilities of the Customer

5.1 The Customer is the owner of its Personal Data and is responsible for the accuracy, legality, integrity, and content reliability of such Personal Data. The Customer shall, in its use of the Services, process Personal Data in accordance with the requirements of Data Privacy Laws and shall ensure that its instructions for the processing of Personal Data comply with Data Privacy Laws.

5.2 The Customer is responsible for ensuring that a valid legal basis exists for the processing of Personal Data under this DPA, including obtaining any consents and providing any notices to Data Subjects required under Data Privacy Laws, and for honoring any opt-out or similar choices exercised by Data Subjects in respect of Personal Data submitted to the Service. The Customer shall notify Windsor.ai in writing without undue delay if it believes that this DPA or the Customer’s instructions no longer satisfy the requirements of Data Privacy Laws.

6. Assistance to the Customer

6.1 Windsor.ai will assist the Customer in ensuring compliance with the Customer’s obligations under Article 32 (security of processing), Article 33 (notification of personal data breaches to supervisory authorities), Article 34 (communication of personal data breach to data subjects), Article 35 (data protection impact assessments) and Article 36 (prior consultation) of the GDPR and equivalent obligations under other Data Privacy Laws, including data protection assessments required under US State Privacy Laws, taking into account the nature of processing and the information available to Windsor.ai, by providing such documentation as is generally available for the Service, including applicable audit reports or certifications. Assistance outside the scope of the Services agreed under the Agreement shall be charged by Windsor.ai at the then-current rate applied by Windsor.ai.

6.2 Windsor.ai shall, taking into account the nature of the processing, assist the Customer by appropriate technical or organizational measures, in the fulfilment of the Customer’s obligations to respond to requests by Data Subjects exercising their rights under Data Privacy Laws, including requests to know, access, correct, delete, port or opt out under US State Privacy Laws. In this respect, Windsor.ai shall provide assistance only upon request by the Customer. Assistance provided through the standard functionality of the Service, and the forwarding of Data Subject requests under this Section 6.2, is included in the Service at no additional charge. Any request directed to Windsor.ai by a Data Subject shall be referred by Windsor.ai to the Customer without undue delay, and Windsor.ai shall not otherwise respond to the Data Subject except to inform them that their request has been forwarded to the Customer. Assistance outside the scope of the Services agreed under the Agreement shall be charged by Windsor.ai at the then-current rate applied by Windsor.ai.

6.3 Windsor.ai shall notify the Customer about any personal data breaches concerning the Customer’s Personal Data without undue delay after having become aware of such personal data breach. To the extent possible, the notification shall include the following information:

(a) description of the nature of the personal data breach, including where possible, the categories and approximate number of Data Subjects and Personal Data records concerned;

(b) the name and contact details of Windsor.ai’s data protection officer or other contacts where further information can be obtained;

(d) description of the measures taken or proposed to be taken to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

6.4 Where it is not possible for Windsor.ai to provide the information as indicated in Section 6.3 at the same time as the notification of the personal data breach, the information may be provided in phases without undue delay.

7. Confidentiality and security

7.1 Windsor.ai shall ensure that all persons authorized to process the Personal Data of the Customer are bound by an obligation of confidentiality with respect to such Personal Data, and only process such Personal Data on instructions from the Customer, unless required to do so under Data Privacy Laws or other law to which Windsor.ai is subject.

7.2 Windsor.ai shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. This shall include at least measures to:

(a) implement and maintain technical and organizational measures for safeguarding the confidentiality, integrity, availability and resilience of systems and services processing Personal Data;

(b) restore the availability and access to Personal Data in a timely manner in the event of an incident;

(c) regularly test, assess, and evaluate the effectiveness of technical and organizational measures for ensuring the security of the processing; and

(d) encrypt Personal Data in transit over public networks and at rest, and pseudonymize Personal Data where specifically agreed by Windsor.ai.

Further details on Windsor.ai’s technical and organizational security measures are available at https://windsor.ai/security/. Windsor.ai maintains independent third-party assurance of its security controls (currently a SOC 2 Type II report), which is published at https://windsor.ai/security/.

7.3 On request by a supervisory authority, Windsor.ai shall cooperate with the supervisory authority in the performance of its tasks and shall comply with decisions by the supervisory authority on security measures required to comply with Data Privacy Laws. If and to the extent the Customer or the supervisory authority instructs Windsor.ai to perform any measure, activity or action outside the scope of the Services agreed to under the Agreement, then such instruction shall be considered a request for additional services pursuant to the Agreement and additional fees may apply.

8. Sub-processors

8.1 The Customer acknowledges that Windsor.ai needs to engage other processors for carrying out specific processing activities and that Windsor.ai wishes to deliver standard services to its customers in a consistent, secure, and efficient manner. Accordingly, the DPA shall constitute a general authorization by the Customer for Windsor.ai’s use of Sub-processors. Windsor.ai shall ensure that Sub-processors are bound by a written agreement that requires them to provide at least the level of data protection required by Windsor.ai under this DPA, including, for Personal Data subject to US State Privacy Laws, obligations equivalent to those set out in Section 12.

8.2 The current list of Sub-processors, including their name, location, and processing activity, is maintained at https://windsor.ai/list-of-sub-processors/.

8.3 Windsor.ai shall inform the Customer of changes concerning its Sub-processors, including the identity and location of new or replaced Sub-processors, by updating the list referred to in Section 8.2 at least fifteen (15) days before the new or replacement Sub-processor begins processing Personal Data, except where an earlier change is required to maintain the security or continuity of the Service, in which case Windsor.ai shall update the list without undue delay. Windsor.ai shall provide a mechanism (such as an email notification list) through which the Customer can subscribe to such updates.

8.4 If the Customer has a reasonable objection on data protection grounds to a new or replacement Sub-processor, it shall notify Windsor.ai in writing within ten (10) days of the update referred to in Section 8.3. In case the Customer objects to the use of a specific Sub-processor, the parties shall enter into good faith negotiations on how to resolve the issue. Such negotiations do not suspend Windsor.ai’s right to use the new Sub-processor. In case the negotiations do not solve the issue and the Customer opposes Windsor.ai’s use of a specific Sub-processor, either party shall, for a justified reason and as a final remedy, be entitled to terminate the Terms of Service on thirty (30) days’ written notice.

8.5 Where a Sub-processor fails to fulfil its data protection obligations, Windsor.ai shall remain fully liable to the Customer for the performance of that Sub-processor’s obligations.

9. International transfers

9.1 Windsor.ai and its Sub-processors may transfer or process Personal Data outside the country or jurisdiction in which the Customer is established, subject to this Section 9.

9.2 EU/EEA Personal Data. For transfers of Personal Data subject to the GDPR by Windsor.ai to a Sub-processor outside the EU/EEA, Windsor.ai shall ensure that the transfer is only made to (a) a country deemed by the European Commission to have an adequate level of protection, (b) entities participating in the EU-US Data Privacy Framework, (c) entities having entered into the EU Standard Contractual Clauses, or (d) recipients providing other appropriate safeguards as described in Article 46 of the GDPR.

9.3 Swiss Personal Data. For transfers of Personal Data subject to the FADP outside Switzerland, Windsor.ai shall ensure that the transfer is only made to countries or recipients providing an adequate level of protection as recognized by the Swiss Federal Council or the FDPIC, to entities participating in the Swiss-US Data Privacy Framework, or on the basis of appropriate safeguards in accordance with the FADP, including the EU Standard Contractual Clauses with the adaptations recognized by the FDPIC.

9.4 UK Personal Data. For transfers of Personal Data subject to the UK GDPR outside the United Kingdom, the transfer shall only be made to a country covered by UK adequacy regulations, to entities participating in the UK Extension to the EU-US Data Privacy Framework, or on the basis of the EU Standard Contractual Clauses as amended by the UK Addendum.

9.5 Other Personal Data. For transfers of Personal Data subject to other Data Privacy Laws that require a transfer mechanism which may be satisfied by the EU Standard Contractual Clauses, the EU Standard Contractual Clauses shall apply.

9.6 Subject to the above and subject to Windsor.ai keeping the Customer informed of the location of Sub-processors in accordance with Section 8, the Customer gives its consent to the transfers and authorizes Windsor.ai to conclude the processor-to-processor module of the EU Standard Contractual Clauses and, where applicable, the UK Addendum with Sub-processors on behalf of the Customer and to represent the Customer regarding those conditions of the standard contractual clauses that refer to the rights and liabilities of the Customer.

10. Retention of Personal Data

10.1 Windsor.ai has no obligation to store, and Windsor.ai will not store, any of the Customer’s Personal Data after the termination of the Customer’s account and/or subscription to the Service, except as set out in this Section 10.1. Windsor.ai will, at the Customer’s choice, promptly delete or return all Personal Data related to the Customer after the end of the provision of the Services relating to processing and delete existing copies, unless applicable legislation requires storage of the Personal Data, in which case Windsor.ai shall continue to protect such Personal Data in accordance with this DPA and shall not process it for any other purpose. Any request for return must be made within thirty (30) days after the end of the provision of the Services, after which the Personal Data will be deleted.

10.2 During the term of the Agreement, Personal Data held in temporary caches is deleted automatically in accordance with Windsor.ai’s retention policy.

11. Audit

11.1 Windsor.ai shall, upon the Customer’s request, make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in this DPA and Data Privacy Laws, including by providing a copy of Windsor.ai’s most recent third-party audit report or certification, subject to confidentiality.

11.2 The Customer or an auditor authorized by the Customer (however, not a competitor of Windsor.ai) is entitled to audit the activities pursuant to the DPA. The parties shall agree on the time of the auditing and other details ahead of time and at the latest 30 days before the inspection. The auditing shall be carried out in a way that does not impede the obligations of Windsor.ai or its Sub-processors in regard to third parties. The representatives of the Customer and the auditor must sign conventional non-disclosure commitments. The Customer shall be responsible for its own and Windsor.ai’s expenses caused by the auditing. The Customer shall not exercise its audit right under this Section 11.2 more than once in any twelve (12) month period, except where required by a supervisory authority or following a personal data breach affecting the Customer’s Personal Data.

11.3 In addition to the reports provided under Section 11.1, the Customer may request that Windsor.ai commission a bespoke audit report by a third-party auditor, for which a separate charge may apply.

12. US State Privacy Laws

12.1 Applicability. This Section 12 applies to the extent that Personal Data processed under this DPA is subject to US State Privacy Laws, in addition to the other provisions of this DPA. In the event of a conflict concerning such Personal Data, this Section 12 prevails.

12.2 Roles and definitions. In respect of such Personal Data, the Customer acts as a business or controller and Windsor.ai acts as a service provider or processor, in each case as defined under the applicable US State Privacy Laws. References in this DPA to “Personal Data”, “Data Subject”, “processing” and “personal data breach” shall be read to include “personal information”, “consumer”, “processing” and “breach of security” as defined in the applicable US State Privacy Laws.

12.3 Business purposes and restrictions. Windsor.ai processes Personal Data only for the business purposes specified in Section 4.4 and the Agreement and in accordance with the Customer’s instructions. Windsor.ai shall not:

(a) sell or share Personal Data, as “sell” and “share” are defined in the CCPA, or otherwise process Personal Data for targeted advertising, as defined in US State Privacy Laws;

(b) retain, use or disclose Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in Section 4.4 and the Agreement, or as otherwise permitted for service providers or processors under US State Privacy Laws;

(c) retain, use or disclose Personal Data outside the direct business relationship between Windsor.ai and the Customer; or

(d) combine Personal Data with personal information that Windsor.ai receives from or on behalf of another person, or collects from its own interactions with consumers, except as expressly permitted for service providers or processors under US State Privacy Laws.

12.4 Compliance. Windsor.ai shall comply with the obligations applicable to service providers and processors under US State Privacy Laws and shall provide the same level of privacy protection as US State Privacy Laws require of the Customer. Windsor.ai shall assist the Customer, in accordance with Section 6, in meeting the Customer’s obligations under US State Privacy Laws, including in relation to the security of the processing and data protection assessments.

12.5 Notification and remediation. Windsor.ai shall notify the Customer without undue delay if it determines that it can no longer meet its obligations under US State Privacy Laws. Upon reasonable notice, the Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data by Windsor.ai, including by instructing Windsor.ai to suspend the processing concerned.

12.6 Verification. The Customer may take reasonable and appropriate steps to ensure that Windsor.ai uses Personal Data in a manner consistent with the Customer’s obligations under US State Privacy Laws, including through the information and audit rights set out in Section 11. Nothing in Section 11.2 prevents the Customer from exercising such rights at least once in any twelve (12) month period where US State Privacy Laws so require.

12.7 Consumer requests. Windsor.ai shall cooperate with the Customer in responding to verifiable consumer requests under US State Privacy Laws in accordance with Section 6.2 and shall, on the Customer’s instruction, delete, correct or make available Personal Data as required to give effect to such requests, unless retention or continued processing is permitted under US State Privacy Laws. Windsor.ai shall forward any consumer request it receives directly to the Customer without undue delay and shall not respond to the consumer except to inform the consumer that the request has been forwarded to the Customer.

12.8 Sub-processors. Windsor.ai shall engage Sub-processors to process Personal Data subject to US State Privacy Laws only under a written contract that imposes obligations no less protective than those in this Section 12, and shall notify the Customer of such engagements in accordance with Section 8.

12.9 Certification. Windsor.ai certifies that it understands the restrictions set out in this Section 12 and will comply with them.

13. Government access requests

13.1 Windsor.ai shall disclose Personal Data to a governmental or law enforcement authority only where required by a legally binding order or request under law applicable to Windsor.ai. When subject to such an order or request, Windsor.ai shall: (a) where legally permitted, promptly notify the Customer in writing so that the Customer may seek a protective order or other appropriate remedy; (b) where there are reasonable grounds to consider the order or request unlawful or overbroad, challenge it or seek to narrow its scope; (c) disclose only the minimum amount of Personal Data required; and (d) use commercially reasonable efforts to obtain confidential treatment for any Personal Data so disclosed.

13.2 Windsor.ai shall not provide any governmental authority with voluntary access to Personal Data, or with encryption keys or other means of access to Personal Data, other than as required under Section 13.1.

14. Damages

14.1 Windsor.ai shall compensate the Customer for damages incurred by the Customer as a result of fault or negligence by Windsor.ai, or by a Sub-processor of Windsor.ai, in the processing of Personal Data in breach of the Terms of Service or this DPA, including for claims by Data Subjects or a supervisory authority against the Customer caused directly by Windsor.ai’s breach of this DPA.

14.2 The parties’ (including their group companies) liability for damages under the DPA shall be limited in scope and to the double of the maximum amounts set out in the Terms of Service, except when limitations of liability are expressly prohibited under the applicable legislation or are otherwise legally invalid or unenforceable. To clarify, indirect damages are excluded.