Legal

Definitions

1. Terms and Conditions: these general terms and conditions of Watermelon B.V., including the privacy policy, the data processing agreement and all additional terms, policies and guidelines that are declared applicable via the Platform or Watermelon’s website.
2. Account: the digital user account through which Customer and Customer’s authorized Users obtain access to the Platform and the Services.
3. Free plan: a free-of-charge form of access offered by Watermelon to (a part of) the Services, without a predetermined term, with limited functionalities, usage options and Usage Limits, as determined by Watermelon.
4. Subscription: a paid form of access to the Services with an agreed billing period, pricing and Usage Limits, as selected via the Platform.
5. Services: all services offered by Watermelon, including but not limited to making the Watermelon Software available via the internet or other networks, including updates, maintenance and supporting functionalities.
6. Documentation: the description of functionalities, usage options and (if applicable) limitations of the Watermelon Software made available online by Watermelon, as published via the Platform or Watermelon’s website.
7. User: any natural person who is authorized by or on behalf of Customer to use the Services.
8. Data: all data, information and content that is entered, stored, processed, generated or exchanged through the Services by or on behalf of Customer or Users, regardless of its nature, form or file format.
9. Usage Limits: the quantitative and/or qualitative limitations determined by Watermelon regarding the use of the Services, depending on the selected Free plan or Subscription.
10. Customer: the natural person or legal entity acting in the exercise of a profession or business that enters into an Agreement with Watermelon.
11. Agreement: any legal relationship between Watermelon and Customer relating to the use of the Services, concluded through electronic acceptance, registration, payment, or actual use of the Services.
12. Personal Data: all information relating to an identified or identifiable natural person as referred to in the General Data Protection Regulation (GDPR).
13. Platform: the online environment managed by Watermelon through which the Services are made available.
14. Plan: the subscription tier selected by Customer with the associated functionalities, pricing and Usage Limits.
15. Watermelon: Watermelon B.V., established in Utrecht and registered with the Dutch Chamber of Commerce under number 66844177.
16. Watermelon Software: the software solution developed and operated by Watermelon for automating and centralizing customer contact.
17. Confidential Information: all non-public information that one party obtains from the other party in connection with the Agreement, regardless of form, including technical, commercial, financial and strategic information.

Applicability & scope

1. These Terms and Conditions apply to all offers, Services, the Free plan, Subscriptions and other legal relationships between Watermelon and Customer.
2. The Agreement is concluded when Customer creates an Account, activates the Free plan, takes out a Subscription, makes a payment or otherwise uses the Services.
3. By electronically accepting these Terms and Conditions or by continued use of the Services, Customer expressly agrees to their applicability.
4. In the event of a conflict between (i) a separately agreed written agreement and (ii) these Terms and Conditions, the separately agreed agreement shall prevail only insofar as it expressly deviates from these Terms and Conditions.
5. The applicability of any general (purchase or other) terms of Customer is expressly rejected.
6. If any provision of these Terms and Conditions is null and void or annulled, the remaining provisions shall remain in full force and effect. The parties shall replace the invalid/annulled provision with a valid provision that, as far as possible, reflects the purpose and intent of the original provision.
7. If the Services (also) depend on products or services of third parties, additional terms of such third parties may apply. Watermelon grants no rights beyond those permitted by such third parties.

Use of the Services

1. Watermelon grants Customer, during the term of the Agreement, a non-exclusive, non-transferable and non-sublicensable right to use the Services in accordance with these Terms and Conditions and the selected Plan.
2. Customer is responsible for the use of the Services by Users and warrants that Users act in accordance with the Agreement and applicable laws and regulations.
3. Customer shall (i) manage access credentials carefully, (ii) not grant access to unauthorized persons, and (iii) inform Watermelon without undue delay in the event of (suspected) unauthorized use or a security incident.
4. Watermelon is entitled to take technical, organizational and security measures to protect the Services and to enforce agreed or established limitations. Customer shall not remove, circumvent or frustrate such measures.
5. Watermelon reserves the right to modify, expand or (partially) discontinue the Services (including functionalities, integrations and technical specifications) in the context of further development, security, compliance or product strategy, with due observance of Article 15 (Changes).
6. Watermelon is entitled to temporarily or permanently suspend or terminate access to (parts of) the Services if Customer fails to comply with its obligations, including payment obligations or breaches of these Terms and Conditions, and/or if this is necessary to prevent damage, abuse or security risks.

Acceptable use, access and security

1. Access to the Services requires the creation and use of an Account. The Account is personal and may only be used by Customer and Users authorized by Customer.
2. Customer is responsible for the secure management and confidentiality of access credentials (such as usernames, passwords and API keys) and shall not make such credentials available to third parties, unless expressly permitted by Watermelon in writing.
3. All actions performed via an Account are deemed to be carried out by or under the responsibility of Customer. Customer is liable for the use of the Services by Users and third parties who gain access through Customer’s Account.
4. Customer shall inform Watermelon without undue delay in the event of (suspected) unauthorized use of an Account, loss or compromise of access credentials, or any security incident that may affect the Services.
5. Customer and Users are not permitted to use the Services:
   • in violation of applicable laws or regulations;
   • in a manner that infringes the rights of third parties, including intellectual property rights, privacy rights or other legal rights;
   • for illegal, misleading, fraudulent, defamatory or harmful purposes, including phishing, spam, distribution of malware or (D)DoS attacks;
   • to transmit, store or distribute offensive, pornographic or otherwise inappropriate content;
   • in any way that disrupts, circumvents or harms the operation, security, integrity or availability of the Services, the Platform or systems of Watermelon or third parties.
6. Customer shall not perform (or allow to be performed) any actions that result in disproportionate load on the Services, including automated or excessive usage that does not align with the selected Plan or reasonable usage expectations (fair use).
7. If, in Watermelon’s reasonable opinion, there is (a risk of) misuse, unauthorized use, security risks or a breach of this article, Watermelon is entitled to take immediate and appropriate measures without prior notice, including:
   • restricting, blocking or suspending access to (parts of) the Services;
   • removing or rendering Data inaccessible;
   • terminating the Agreement.
8. In the event of measures taken under this article, Watermelon is not obliged to refund any fees or provide any compensation, without prejudice to mandatory law.

Usage Limits, Consumption and Fair Use

1. The use of the Services is subject to the Usage Limits applicable to the selected Plan or Free plan. The current Usage Limits and (where applicable) usage-based rates are published by Watermelon via the Platform and/or in the Documentation.
2. Unless mandatory law provides otherwise, Watermelon’s measurements and records regarding use, consumption, quantities, interactions and other usage metrics are leading and binding, subject to Customer providing evidence to the contrary.
3. If Usage Limits are exceeded, Watermelon is entitled to (i) charge additional usage fees in accordance with the applicable rates and (ii) block the use of the Services in whole or in part.
4. If the exceedance is structural or, in Watermelon’s reasonable opinion, does not fit within the selected Plan, Watermelon is entitled to require an upgrade to an appropriate Plan as a condition for continued use. If Customer does not upgrade in time, Watermelon may block (parts of) the Services.
5. Fair use includes, among other things, the prohibition of improper, excessive, fraudulent or abusive use, including (non-exhaustively) sending spam, performing (automated) burdensome actions, abusing integrations/APIs, or use that may harm the stability, security or reputation of Watermelon or third parties.
6. In the event of (suspected) breach of fair use, Watermelon is entitled to take appropriate measures, including rate limiting, temporary blocking, suspension or termination, without being obliged to provide any refund or compensation.

Support and availability

1. Watermelon provides support in relation to the Services in accordance with the selected Plan. The support channel, response times and any limitations may differ per Plan and are published via the Platform or the Documentation.
2. For the Free plan, no availability guarantee applies, no guaranteed response times apply, and there is no obligation to provide any specific level of support.
3. For paid Subscriptions, Watermelon aims for an average availability of the Services of 99% per calendar month, excluding (i) scheduled maintenance, (ii) announced updates, (iii) force majeure, and (iv) circumstances outside Watermelon’s reasonable control.
4. Watermelon is entitled to temporarily (partially) take the Services out of operation for maintenance, updates or security measures. Where reasonably possible, Watermelon will announce scheduled maintenance in advance via the Platform and/or a status page and will try to carry this out outside peak times.
5. Downtime or reduced availability does not entitle Customer to service credits or any other compensation, without prejudice to any mandatory rights.

Term and termination

1. Subscriptions are entered into for the billing period selected by Customer (“contract term”). The billing period may be monthly or yearly, depending on the selected Plan.
2. A Subscription is automatically renewed after the end of the current billing period for an identical term, unless Customer cancels via the Platform before the end of the current billing period.
3. Customer can set cancellation at any time via the Platform. After cancellation, access to the Services remains available until the end of the current billing period.
4. Early termination by Customer does not lead to a refund of fees already paid, unless mandatory law provides otherwise.
5. Downgrades of a Subscription take effect at the end of the current billing period. If Customer changes downgrade settings during the term, the higher Plan remains applicable until the end of the current billing period.
6. After termination of the Agreement, Customer is responsible for timely exporting or securing Data. Watermelon is entitled, after a reasonable period following termination, to delete the Data, unless a longer retention period is legally required.
7. Watermelon is entitled to modify or discontinue the Free plan. If the Free plan is discontinued, Watermelon may terminate access to the Account and delete Data, observing a reasonable period for export, unless termination is necessary due to abuse, security, or a legal obligation.

Customer obligations

1. Customer is responsible for (i) selecting the appropriate Plan, (ii) configuring and using the Services, and (iii) how Customer applies the output of the Services within its processes. Watermelon does not guarantee that the Services are fit for Customer’s specific purpose.
2. Customer is responsible for the availability and security of its own systems, network connections and equipment required to access the Services.
3. Customer warrants the lawfulness of (i) the Data processed, (ii) the instructions given to the Services, and (iii) the deployment of the Services in accordance with applicable laws and regulations, including privacy and consumer law where relevant.
4. Customer warrants that the Data does not infringe the rights of third parties (including intellectual property, privacy and portrait rights) and is not unlawful. Customer indemnifies Watermelon against third-party claims arising therefrom.
5. Customer shall ensure that Users comply with (access) instructions and security measures and do not perform acts that may harm the Services or their security.

Fees, invoicing and payment

1. The fee for the Services consists of (i) fixed subscription fees for the selected Plan and (ii) where applicable, usage-based fees (such as fees based on consumption or numbers of interactions/conversations), in accordance with the rates published on the Platform.
2. Subscription fees are payable in advance for the selected billing period and are not dependent on actual use. Unless otherwise stated on the Platform, usage-based fees are invoiced in arrears based on measured actual use.
3. All prices are in euros and exclude VAT, unless expressly stated otherwise. Customer is not entitled to suspend or set off payments, except as required by mandatory law.
4. Payment is made via the payment methods offered by Watermelon, including (but not limited to) Stripe as Watermelon’s payment service provider. By providing payment details and authorizing a payment method, Customer authorizes Watermelon (and its payment partners) to collect amounts due in accordance with the Agreement.
5. If an automatic payment fails, Watermelon is entitled to make one or more new collection attempts. If payment remains outstanding, Watermelon may request Customer to pay manually within a term set by Watermelon.
6. In the event of late payment, Customer is in default by operation of law. Watermelon is entitled to (i) suspend (parts of) the Services, (ii) block access, and/or (iii) dissolve (parts of) the Agreement, without prejudice to Watermelon’s right to payment of outstanding amounts.
7. In the event of late payment, Customer owes statutory commercial interest pursuant to Section 6:119a of the Dutch Civil Code from the due date until the date of full payment.
8. All reasonable extrajudicial and judicial costs incurred by Watermelon to obtain payment shall be borne by Customer, subject to mandatory law (including, where applicable, the Dutch Extrajudicial Collection Costs Act).
9. Complaints regarding invoices must be submitted to Watermelon in writing within twenty-one (21) days after the invoice date via the channel designated by Watermelon (for example finance@watermelon.ai). Failing this, the invoice shall be deemed accepted, without prejudice to any mandatory rights.

Confidentiality

1. The parties shall treat Confidential Information as strictly confidential, shall not disclose it to third parties and shall use it solely for the performance of the Agreement.
2. The confidentiality obligation does not apply to information for which the receiving party can demonstrate that it: (i) was already lawfully in its possession, (ii) became public without breach of this obligation, (iii) was lawfully obtained from a third party without a confidentiality obligation, or (iv) was independently developed without using Confidential Information.
3. Disclosure is permitted if and insofar as a party is required to do so under applicable laws or a binding order from a competent authority, provided that (where permitted) such party informs the other party in advance and limits the disclosure to what is strictly necessary.
4. Customer shall impose the obligations under this article on its employees and third parties engaged who have access to Confidential Information.

Intellectual property

1. All intellectual property rights relating to the Services, the Platform, the Watermelon Software, the Documentation, designs, analyses, (model) prompt structures, methods and other materials developed by Watermelon vest exclusively in Watermelon and/or its licensors. No rights are transferred.
2. Customer only obtains the right of use necessary to use the Services in accordance with the Agreement. The right of use expressly does not include access to source code or underlying models/techniques, unless expressly agreed in writing.
3. All rights to the Data vest in Customer or its licensors. Customer grants Watermelon a non-exclusive, worldwide license to host, process and use the Data for the purpose of providing the Services and for maintenance, security and support.
4. Customer indemnifies Watermelon against third-party claims relating to (alleged) infringement of intellectual property rights or other third-party rights as a result of the Data or Customer’s use of the Services.
5. Customer shall not remove Watermelon indications (such as copyright notices, trademarks and logos) where these reasonably form part of the Services or Documentation.

Privacy and data processing

1. Insofar as Watermelon processes Personal Data in the context of the Services on behalf of Customer, Customer acts as controller and Watermelon as processor within the meaning of the GDPR.
2. Watermelon’s data processing agreement forms an integral part of the Agreement and is made available via the Platform or upon request.
3. Watermelon processes Personal Data solely (i) on the basis of documented instructions from Customer and (ii) to the extent necessary for the performance of the Services, unless processing is required by a legal obligation.
4. Watermelon implements appropriate technical and organizational measures to secure Personal Data, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing.
5. Watermelon is entitled to engage sub-processors. Watermelon ensures appropriate contractual safeguards with sub-processors and may publish changes regarding sub-processors via the Platform, the Documentation or in another reasonable manner.
6. Transfers outside the EEA shall take place only in compliance with the requirements of Chapter V GDPR (for example on the basis of Standard Contractual Clauses or other valid safeguards).

Force majeure

1. A failure to perform shall not be attributable to Watermelon if it is the result of force majeure.
2. Force majeure includes (non-exhaustively): failures in internet or telecommunication infrastructure, power outages, (D)DoS attacks, fire, flooding, strikes, government measures, war, pandemics, and failures of third parties engaged by Watermelon (such as hosting or cloud providers), insofar as these are outside Watermelon’s reasonable control.
3. If the force majeure situation continues for more than three (3) months, both parties are entitled to terminate the Agreement in writing without liability for damages, insofar as permitted by mandatory law.

Liability

1. Watermelon is only liable for direct damage that is the direct result of an attributable failure by Watermelon to perform the Agreement, and liability is excluded in all cases insofar as there is intent or deliberate recklessness on the part of Customer or Users.
2. Watermelon’s total liability per damaging event (with a series of related events considered as one event) is limited to the amount paid by Customer to Watermelon in the twelve (12) months preceding the damaging event (excluding VAT), with an absolute maximum of the amount paid in that period.
3. Watermelon is not liable for indirect or consequential damages, including (but not limited to): loss of profit, missed savings, loss of goodwill, business interruption, delay damages, loss or corruption of data, third-party penalties and damages arising from third-party claims.
4. For the Free plan, given its free-of-charge nature, a further limitation of liability applies: Watermelon is not liable for any damages, except for liability that cannot be excluded under mandatory law.
5. Customer indemnifies Watermelon against all third-party claims relating to (i) the Data, (ii) Customer’s or Users’ use of the Services, or (iii) Customer’s breach of laws or regulations.

AI functionalities and responsibility

1. To the extent that the Services generate output using (generative) AI, such output is for informational purposes only and does not qualify as professional advice (legal, medical, financial or otherwise).
2. Watermelon provides no guarantees regarding the accuracy, completeness, timeliness or suitability of AI output. AI output may contain inaccuracies and may deviate from expectations.
3. Customer remains fully responsible for (i) assessing AI output, (ii) using it in customer communications or processes, and (iii) decisions made on the basis thereof.
4. Watermelon is entitled to use AI output and usage data in anonymized and/or aggregated form for quality improvement, security, analytics and product development, provided this does not include identifiable Personal Data other than as permitted under the GDPR and the data processing agreement.

Changes

1. Watermelon is entitled to change the Services, the Free plan, Plans, prices, Usage Limits and the Documentation, including in connection with product development, market developments, compliance, or changes by third parties on which Watermelon depends.
2. Changes to prices, Plans or Usage Limits for paid Subscriptions will take effect from the next billing period, unless a change is (i) legally required or (ii) necessary to mitigate security or abuse risks; in such cases Watermelon may intervene earlier.
3. Watermelon may communicate changes via the Platform, by email and/or through other reasonable electronic means. Continued use of the Services after the effective date constitutes acceptance of the changes.
4. If Customer does not accept a change, Customer may terminate the Agreement effective at the end of the current billing period via the Platform. This does not affect payment obligations for the current period.

Miscellaneous provisions

1. Watermelon is entitled to engage third parties in the performance of the Services. Watermelon remains responsible for managing such third parties, without prejudice to the exclusions and limitations in these Terms and Conditions.
2. Any time limits stated by Watermelon are indicative and shall not be considered strict deadlines, unless expressly agreed otherwise in writing.
3. Watermelon is entitled to assign its rights and obligations under the Agreement to an affiliated company or in the context of a restructuring, merger or transfer of business. Customer will be notified thereof in a reasonable manner.

Governing law and jurisdiction

1. All legal relationships between Watermelon and Customer are governed exclusively by Dutch law.
2. Disputes arising out of or relating to the Agreement shall, in the first instance, be submitted exclusively to the competent court of the District Court of Midden-Nederland, location Utrecht, unless mandatory law provides otherwise.
3. Changes in Watermelon’s (direct or indirect) control, trade name or legal form do not constitute grounds for dissolution or termination by Customer, without prejudice to mandatory law.

Effective Date and Applicability

1. These Terms and Conditions apply as of 20-01-2026 (the “Effective Date”). For Agreements concluded prior to the Effective Date, the terms and conditions in force at the time of conclusion will continue to apply, unless Customer electronically accepts this version after the Effective Date (for example by continued use of the Services after notice)

Definitions of legal terms

The GDPR uses a variety of legal terminology. In order to make this Data Processing Agreement understandable, the following terms have the meanings set out below. Terms not defined here have the meaning given in the GDPR or the Master Agreement.

Personal Data: any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.

Data Subject: the natural person to whom Personal Data relate.

Processing (of Personal Data): any operation or set of operations performed on Personal Data, as defined in Article 4(2) GDPR.

Controller / Data Controller: the person or organization that determines the purposes and means of Processing (Article 4(7) GDPR). Under this DPA, “you” (the customer) are the Controller.

Processor / Data Processor: the person or organization that Processes Personal Data on behalf of the Controller (Article 4(8) GDPR). Under this DPA, Watermelon is the Processor.

Sub-processor: a third party engaged by the Processor to Process Personal Data on behalf of the Controller.

Third Party: a natural person or legal entity, public authority, agency or body other than the Data Subject, Controller, Processor and persons authorized to Process Personal Data under the direct authority of the Controller or Processor (Article 4(10) GDPR).

Master Agreement: the agreement(s) between you and Watermelon governing the provision of the Services, including any order form, online checkout, quotation, general terms and conditions and other incorporated documents, to which this DPA is an addendum.

Trust Center: Watermelon’s online security and compliance portal available at https://trust.watermelon.ai, including (without limitation) information on subprocessors and security measures.

Data Processing Agreement / DPA: this agreement, including its annexes, describing the Processor’s Processing of Personal Data on behalf of the Controller.

Who is who?

If you read “you”, “your” or “yours” in this DPA, we refer to you as the customer of Watermelon and the entity that has entered into the Master Agreement with Watermelon (the Controller).

If you read “we”, “our” or “ours”, we refer to Watermelon B.V., having its registered office at Vleutenseweg 386, 3532 HW, Utrecht, the Netherlands, registered with the Dutch Chamber of Commerce under number 66844177 (the Processor).

Watermelon may offer integrations with third-party services (for example social platforms). Such third parties may process Personal Data under their own terms and as independent controllers. Watermelon is not responsible for third-party processing outside the scope of the Services, and you remain responsible for assessing and accepting third-party terms where you enable integrations.

When is this DPA in effect? Can this DPA be ended separately?

1. This DPA is concluded and becomes effective when you accept the Master Agreement (including by online acceptance) or when you otherwise access or use the Services after this DPA is made available to you.
2. This DPA forms an integral part of the Master Agreement. If the Master Agreement ends, this DPA ends automatically. This DPA cannot be terminated independently without terminating the Master Agreement.
3. Upon termination of the Master Agreement, the Controller may export or retrieve Personal Data in accordance with the Master Agreement. Watermelon applies a standard retention grace period of up to 90 days after termination to enable export/retrieval, after which Personal Data will be deleted or anonymized, unless Watermelon is required by law to retain certain data for a longer period.

What Personal Data do we process and for what purposes?

1. Watermelon Processes Personal Data only for the purposes of providing, maintaining, securing and supporting the Services as described in the Master Agreement, and only on documented instructions from you, including instructions resulting from your configuration and use of the Services.
2. Watermelon will Process Personal Data in accordance with this DPA, the Master Agreement, the GDPR and other applicable laws concerning the protection of Personal Data.
3. Watermelon does not intentionally Process special categories of personal data (Article 9 GDPR) and data relating to criminal convictions and offences (Article 10 GDPR). If you choose to include such data in the Services, you represent and warrant that you have a valid legal basis and that appropriate safeguards are in place; you remain responsible for such Processing as Controller.
4. A general description of Processing (including categories of Data Subjects and Personal Data) is set out in Annex 1. This description may be refined over time to reflect the Services, provided that such changes do not materially reduce the protections in this DPA.

Your responsibilities as Controller

1. You warrant that you have a valid legal basis to collect and Process Personal Data and to instruct Watermelon to Process Personal Data on your behalf, and that your instructions comply with applicable law.
2. You are responsible for the accuracy, quality and legality of the Personal Data and the means by which you acquired them.
3. You remain responsible for determining appropriate retention periods, data minimisation, access management on your side, and for informing Data Subjects (including via your own privacy notices) about Processing through the Services.
4. You shall promptly notify Watermelon if you become aware of inaccuracies, unlawful Processing, or any instruction that conflicts with applicable law.

Confidentiality

1. Watermelon will treat all Personal Data it Processes on your behalf as confidential and will ensure that persons authorized to Process Personal Data are bound by confidentiality obligations (contractual or statutory).
2. Watermelon may disclose Personal Data only (i) on your documented instruction, (ii) to authorized Sub-processors in accordance with this DPA, or (iii) where required by applicable law. Where legally permitted, Watermelon will notify you of such legal requirement before disclosure.

Where is Personal Data processed and how is it secured?

1. Watermelon hosts and Processes Personal Data primarily within the European Economic Area (“EEA”), except where otherwise disclosed in the Trust Center or required for specific features (for example certain third-party subprocessors).
2. Watermelon implements appropriate technical and organizational measures (“TOMs”) to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, costs of implementation, nature, scope, context and purposes of Processing, and the risks to Data Subjects.
3. A current description of Watermelon’s security measures is maintained in the Trust Center at https://trust.watermelon.ai. Watermelon may update its TOMs provided that such updates do not materially reduce the overall level of security.

Personal Data Breaches

1. A “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data (Article 4(12) GDPR).
2. Watermelon will notify you without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed on your behalf.
3. Watermelon will provide information reasonably required to support your obligations under Articles 33 and 34 GDPR, taking into account the information available to Watermelon.
4. You remain responsible for assessing whether notification to a supervisory authority or Data Subjects is required and for making such notifications, unless otherwise required by law.

Data Subject rights and Controller assistance

Data Subjects have rights under the GDPR (including access, rectification, erasure, restriction, portability and objection). As Controller, you are responsible for responding to Data Subject requests. Watermelon will provide reasonable assistance (through features, documentation, and support) to enable you to fulfil your obligations, taking into account the nature of Processing.

If Watermelon receives a Data Subject request directly, Watermelon will forward it to you without undue delay and will not respond directly unless required by law or authorized by you.

Sub-processors and third-party access

1. You grant Watermelon a general authorization to engage Sub-processors for the provision of the Services.
2. Watermelon maintains an up-to-date list of Sub-processors in the Trust Center at https://trust.watermelon.ai/subprocessors.
3. Watermelon will inform you of intended changes to the Sub-processor list by updating the Trust Center and/or by other reasonable electronic means. If you continue to use the Services after such notice, you are deemed to have accepted the updated Sub-processor list.
4. You may object to a new Sub-processor on reasonable data protection grounds by notifying Watermelon within 30 days after the notice. If the parties cannot reasonably resolve the objection, you may terminate the affected part of the Services in accordance with the Master Agreement, without penalty, effective at the end of the then-current billing period (unless otherwise agreed).
5. Watermelon remains responsible for the performance of its Sub-processors to the same extent as if Watermelon performed the services of such Sub-processor itself.

International transfers

1. If Processing involves transfers of Personal Data outside the EEA, Watermelon will ensure appropriate safeguards in accordance with Chapter V GDPR (for example, Standard Contractual Clauses or other valid transfer mechanisms), as further described (where applicable) in the Trust Center.

Assistance with DPIAs and supervisory authorities

1. Taking into account the nature of Processing and the information available to Watermelon, Watermelon will provide reasonable assistance to you with Data Protection Impact Assessments (“DPIAs”) and, where applicable, prior consultation with a supervisory authority.
2. Where such assistance requires substantial effort beyond standard support, Watermelon may charge reasonable fees, which will be communicated in advance.

Liability

1. Each party remains responsible for its own compliance with the GDPR and other applicable data protection laws in its respective role (Controller or Processor).
2. To the extent Watermelon is liable in connection with this DPA, the liability limitations and exclusions in the Master Agreement apply to the maximum extent permitted by law.
3. You will indemnify Watermelon for third-party claims, fines or penalties to the extent they result from your unlawful instructions, your failure to meet your obligations as Controller, or your unlawful use of the Services, except to the extent caused by Watermelon’s breach of this DPA or applicable law.

Audits and compliance verification

You have the right to verify Watermelon’s compliance with this DPA. The parties agree that verification should, where possible, be satisfied through documentation, certifications and reports made available in the Trust Center.

• If you have reasonable grounds to believe Watermelon is not complying with this DPA, you may request additional information or an audit. Watermelon may provide an independent third-party audit report (where available) as an alternative to an on-site audit.
• Any audit must be: (i) notified in writing at least 30 days in advance, (ii) limited in scope to the relevant Processing, (iii) conducted during normal business hours, (iv) subject to appropriate confidentiality obligations, and (v) not unreasonably interfere with Watermelon’s operations.
• Audits are at your expense. Watermelon may require the auditor to be independent and appropriately qualified, and may reject an auditor with a conflict of interest or inadequate confidentiality assurances.
• Audit results shall be treated as confidential. You may share results with your regulators or external counsel on a need-to-know basis under confidentiality obligations.

How do we handle disputes?

1. If a dispute arises, the parties will use reasonable efforts to resolve it amicably. If the dispute cannot be resolved, it shall be submitted exclusively to the competent court of the judicial district Central Netherlands (Midden-Nederland), location Utrecht, the Netherlands, unless mandatory law provides otherwise.
2. Dutch law applies to this DPA and any non-contractual obligations arising out of or in connection with it.

Order of precedence

If there is any conflict between this DPA and the Master Agreement with respect to the Processing of Personal Data, this DPA shall prevail. For all other matters, the Master Agreement shall apply.

Definitions

1. GDPR: the General Data Protection Regulation (EU) 2016/679.
2. Watermelon: Watermelon B.V., established in Utrecht, the Netherlands, registered with the Dutch Chamber of Commerce under number 66844177.
3. Website: the Watermelon website available at www.watermelon.ai and related subdomains.
4. Platform / Software: the software environment provided by Watermelon through which Customers use AI Agents and related functionalities.
5. Customer (Controller): the natural person or legal entity acting in the course of business that uses the Platform.
6. User: any natural person authorised by or on behalf of the Customer to access the Platform.
7. Visitor: any natural person who visits the Website.
8. Personal Data: any information relating to an identified or identifiable natural person as defined in Article 4(1) GDPR.
9. Processing: any operation or set of operations performed on Personal Data as defined in Article 4(2) GDPR.
10. Controller: the party that determines the purposes and means of the Processing of Personal Data (Article 4(7) GDPR).
11. Processor: the party that processes Personal Data on behalf of the Controller (Article 4(8) GDPR).
12. Subprocessor: a third party engaged by Watermelon to process Personal Data.
13. Trust Center: Watermelon’s online compliance and security portal available at https://trust.watermelon.ai.

Applicability and Scope

1. This Privacy Policy applies to all Processing of Personal Data by Watermelon in connection with:
   • use of the Website by Visitors;
   • use of the Platform by Customers and Users;
   • commercial, contractual, and statutory activities of Watermelon.
2. This Privacy Policy does not apply to third-party websites or services that are linked to or referenced.

Roles and Responsibilities

1. With respect to Personal Data of Visitors, Watermelon acts as Controller.
2. With respect to Personal Data processed via the Platform, the Customer acts as Controller and Watermelon acts as Processor.
3. The arrangements governing such Processing are set out in the Data Processing Agreement, which forms an integral part of the General Terms and Conditions.

Categories of Personal Data

1. Watermelon may process the following categories of Personal Data:
   • identification and contact details (such as name, email address, phone number);
   • account and user data;
   • communication data;
   • technical and usage data (such as IP address, logs, browser data);
   • billing and payment data.

Purposes and Legal Bases

1. Watermelon processes Personal Data exclusively for legitimate purposes, including:
   • providing, maintaining, and improving the Platform;
   • performing agreements;
   • customer support and service;
   • billing and administration;
   • security, compliance, and fraud prevention;
   • marketing and communications, where permitted.
2. Processing is based on one or more legal grounds as referred to in Article 6 GDPR.

Special Categories of Personal Data and Minors

1. Watermelon does not intentionally process special categories of Personal Data.
2. If the Customer chooses to process such data through the Platform, the Customer remains fully responsible for such Processing.
3. The Platform and Website are not intended for use by minors.

Retention Periods

1. Personal Data are not retained longer than necessary for the purposes for which they were collected.
2. Following termination of the agreement, a standard retention grace period of up to 90 days applies, unless a longer retention period is required by law.

Sharing of Personal Data and Subprocessors

1. Watermelon shares Personal Data with third parties only where necessary for the provision of the Platform or where legally required.
2. Watermelon engages Subprocessors under appropriate contractual safeguards.
3. An up-to-date list of Subprocessors is available via the Trust Center.

International Data Transfers

1. Where Personal Data are transferred outside the European Economic Area, Watermelon ensures appropriate safeguards in accordance with Chapter V GDPR.

Security Measures

1. Watermelon implements appropriate technical and organisational measures to protect Personal Data.
2. Further information on security measures is available via the Trust Center.

Rights of Data Subjects

1. Data subjects have the rights provided under the GDPR, including the right of access, rectification, erasure, restriction, and data portability.
2. Requests may be submitted via contact@watermelon.ai.

Personal Data Breaches

1. Watermelon maintains procedures for detecting, reporting, and investigating personal data breaches in accordance with the GDPR.

Cookies and Tracking

1. For information on cookies and similar technologies, please refer to our Cookie Statement.

Changes to this Privacy Policy

1. Watermelon may amend this Privacy Policy from time to time. The most recent version is always available on the Website.

Contact and Complaints

1. For questions or complaints regarding this Privacy Policy, please contact us at contact@watermelon.ai.
2. You also have the right to lodge a complaint with a competent supervisory authority.