Data Processing Addendum

For the purposes of personal data processed under the services, the customer acts as Controller or, where applicable, as Processor on behalf of its own controller. MOBISSP LIMITED, operating LingCoreX.AI, acts as Processor.

LingCoreX.AI provides a unified routing and orchestration layer for eligible third-party AI model providers and related support services. This DPA applies only to personal data processed by LingCoreX.AI on the customer's documented instructions.

This DPA applies for as long as LingCoreX.AI processes personal data on behalf of the customer in connection with the services.

Processing begins when the customer submits or causes personal data to be submitted through the services and continues for the period necessary to provide the services, perform agreed support functions, comply with legal obligations, and complete return or deletion obligations under the agreement.

LingCoreX.AI processes data for request authentication, routing, model orchestration, quota enforcement, usage-based billing, abuse prevention, operational troubleshooting, and customer support.

LingCoreX.AI is designed as a stateless-first AI routing layer. By default, customer prompt and response content is not used for model training by LingCoreX.AI and is not retained by LingCoreX.AI for long-term storage unless an explicitly enabled service configuration requires additional handling.

Depending on customer usage, data subjects may include the customer's users, employees, contractors, end users, or other persons whose data is included in API requests or support interactions.

Categories of personal data may include account identifiers, contact information, API usage metadata, request and response content submitted by the customer, support records, and security or billing-related technical records, to the extent such data contains personal data.

The customer instructs LingCoreX.AI to process personal data solely as necessary to provide the services and as further documented through the service configuration, API usage, support requests, and written instructions consistent with the agreement.

If LingCoreX.AI believes an instruction infringes applicable data protection law, it may notify the customer and suspend the relevant processing to the extent reasonably necessary.

LingCoreX.AI will ensure that personnel authorised to process personal data are subject to appropriate confidentiality obligations.

Access to personal data must be limited to personnel who need such access to operate, secure, support, or improve the reliability of the services within the boundaries of the applicable agreement and service configuration.

LingCoreX.AI will implement and maintain reasonable technical and organisational measures appropriate to the nature of the services and the risks presented by the processing, as applicable under the active service configuration.

Such measures may include controls relating to encryption in transit, access restriction, environment segregation, key handling, logging discipline, abuse prevention, and incident response, but only to the extent actually implemented for the relevant service environment.

The customer authorises LingCoreX.AI to engage sub-processors where necessary to provide the services, including infrastructure providers, payment or support providers, and eligible upstream AI model providers selected through the service.

A current sub-processor list will be maintained separately and referenced by the legal pages or applicable annexes. Where required by law or contract, LingCoreX.AI will provide notice of material sub-processor changes through the applicable communication channel.

Because LingCoreX.AI may route requests to globally distributed infrastructure or upstream providers, personal data may be processed in countries outside the customer's jurisdiction, subject to the customer's selected service configuration.

Where required, international transfers will be supported through applicable transfer mechanisms, including standard contractual clauses or equivalent safeguards referenced in the relevant agreement or annex.

Taking into account the nature of the processing, LingCoreX.AI will provide reasonable assistance to help the customer respond to data subject requests, insofar as such requests relate to data processed by LingCoreX.AI on the customer's behalf and the customer cannot reasonably fulfil the request without such assistance.

This assistance is subject to the information available to LingCoreX.AI, the customer's service configuration, and any lawful limitations applicable to the request.

LingCoreX.AI will notify the customer without undue delay after becoming aware of a confirmed security incident affecting personal data processed on the customer's behalf, where such notification is required under applicable law or contract.

Notifications may include the known nature of the incident, affected systems or data categories, and reasonable updates as additional information becomes available.

Upon termination or expiration of the services, LingCoreX.AI will, subject to applicable law and the customer's active service configuration, delete or return personal data retained on the customer's behalf within systems controlled by LingCoreX.AI.

Where the customer has enabled audit or retention features that write data to customer-controlled storage, the customer remains responsible for deletion or lifecycle management within that storage environment.

Upon reasonable written request and subject to confidentiality, security, and proportionality safeguards, LingCoreX.AI may provide information reasonably necessary to demonstrate compliance with this DPA.

Liability arising under this DPA is subject to the limitations, exclusions, and allocation of risk set out in the main service agreement, unless mandatory law requires otherwise.

Questions regarding this DPA should be directed through the support or legal contact channel identified in the main agreement, dashboard, or legal pages made available by LingCoreX.AI.

Sub-processor details, security summaries, regional routing options, and transfer annexes may be provided through linked legal pages, service documentation, or negotiated commercial documents where applicable.