Version 1.0. Effective from 6 November 2026
between
(1) Sundae Bar AI PLC
(2) the Customer (any user of Sundae who is not a Consumer)
This Addendum forms part of the Sundae Terms of Use for business users.
Background
(A) Sundae is designed for personal use by Consumers. Where a user is not a Consumer, or uses Sundae for business purposes, Sundae will process personal data in that user's Content on the user's behalf.
(B) Data protection law requires that processing by a processor on behalf of a controller is governed by a binding contract containing certain terms. This Addendum is that contract.
Agreed terms
1. Application and interpretation
1.1 This data processing addendum (the “Addendum”) is between Sundae Bar AI PLC, company number 13714088, of c/o Druces LLP, 6th Floor, 99 Gresham Street, London EC2V 7NG (“we”, “us”, “our”) and each user of the Service who is not a Consumer, or who uses the Service for business purposes (the “Customer”, “you”). It forms part of the Terms of Use at sundae.md (the “Terms”) and applies from the moment you first use the Service other than as a Consumer.
1.2 Capitalised words not defined here have the meaning given in the Terms. In this Addendum:
| Account Data | personal data relating to the Customer and its personnel as users of the Service, including contact details, settings, billing data, technical data, usage events, logs and support correspondence, which we process for our own purposes as described in the Privacy Policy; |
| Customer Personal Data | personal data contained in Your Content that we process on the Customer's behalf in providing the Service, including personal data in Instructions, conversations, memory, files, Hosted Content, email and data retrieved from Connected Services; |
| Data Protection Law | the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and, where applicable to the processing, the EU GDPR and the laws of EEA member states implementing it, in each case as amended or replaced from time to time; |
| Sub-processor | any third party engaged by us to process Customer Personal Data on our behalf; |
| UK GDPR | Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018. |
1.3 “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in Data Protection Law.
1.4 If there is a conflict between this Addendum and the Terms or the Privacy Policy on a matter of data protection, this Addendum prevails. If there is a conflict between this Addendum and any transfer mechanism referred to in clause 7, the transfer mechanism prevails to the extent of the conflict.
2. Roles of the parties
2.1 In relation to Customer Personal Data, the Customer is the controller (or, where the Customer acts for another controller, a processor) and we are the Customer's processor. Annex 1 describes the processing.
2.2 In relation to Account Data, we are an independent controller and process it as described in the Privacy Policy. Nothing in this Addendum restricts that processing.
2.3 The Customer warrants and undertakes that: (a) it has a lawful basis for the processing of Customer Personal Data by the Service and for each Instruction it gives; (b) it has given data subjects any notice, and obtained any consent, that Data Protection Law requires; (c) its Instructions comply with Data Protection Law; and (d) it will not use the Service to process special category data or criminal offence data except where it has a lawful basis under Articles 9 and 10 of the UK GDPR.
2.4 The Customer acknowledges that Sundae acts on Instructions interpreted by third-party AI models, as described in the Terms, and that in carrying out an Instruction Sundae may share Customer Personal Data with Merchants, websites, Connected Services and recipients, who are independent controllers chosen by the Customer. The Customer is responsible for the consequences of its Instructions, including those disclosures.
3. Instructions
3.1 We will process Customer Personal Data only on the Customer's documented instructions, which are: (a) the Terms and this Addendum; (b) the Instructions the Customer gives to Sundae through the Service; (c) the settings the Customer configures; and (d) any further written instructions the Customer gives and we agree to. We may process Customer Personal Data otherwise only where required by law, in which case we will tell the Customer before processing unless the law prohibits it.
3.2 Without limiting clause 3.1, the Customer instructs us to:
(a) process Customer Personal Data to provide the Service and carry out Instructions, including by sending it to the Sub-processors in Schedule 1 to the Privacy Policy;
(b) share Customer Personal Data with Merchants, websites, Connected Services and recipients as each Instruction requires;
(c) transfer Customer Personal Data internationally as described in clause 7;
(d) use Customer Personal Data to improve the Service as described in the Privacy Policy, including to evaluate and tune the prompts, tools and models Sundae uses, removing direct identifiers where practicable before any training or fine-tuning. The Customer may withdraw this instruction at any time by notice to the address in clause 13.5, and we will cease that use of its Customer Personal Data within 30 days of receipt, without affecting improvements already made.
3.3 We will inform the Customer if, in our opinion, an Instruction infringes Data Protection Law. We are not obliged to review Instructions for that purpose, and we may decline to act on any Instruction we consider unlawful.
3.4 The Customer acknowledges that, because Sundae interprets Instructions using AI, the processing performed in carrying out an Instruction is the processing that a reasonable reading of the Instruction requires, as described in clause 5.6 of the Terms, and that Sundae may misinterpret an Instruction. Processing carried out in good faith on such an interpretation is processing on the Customer's instructions for the purposes of this Addendum.
4. Confidentiality and personnel
4.1 We will ensure that any person we authorise to process Customer Personal Data is bound by an obligation of confidentiality, whether contractual or statutory, and processes it only as this Addendum permits.
4.2 We restrict access to conversation content to personnel who need it for legality, safety, troubleshooting or support, and we log each access.
5. Security
5.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to data subjects, we will implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our measures as at the Effective Date are described in Annex 2. We may update them from time to time provided the overall level of protection is not materially reduced.
5.2 The Customer is responsible for its own security, including the security of its devices, messaging accounts, passkeys, links and codes; for the Instructions it gives and the settings it chooses, including the Spending Limit and the approved recipient list; for deciding what Customer Personal Data to share with the Service; and for its own backups.
5.3 The Customer acknowledges that the Service is beta software, as described in the Terms, and that the measures in Annex 2 are appropriate to that context and to a Service designed for personal use.
6. Sub-processors
6.1 The Customer gives us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Schedule 1 to the Privacy Policy, and the Customer approves them by entering into this Addendum.
6.2 We will publish changes to the list at sundae.md at least 14 days before a new Sub-processor begins processing Customer Personal Data, except where a change is needed urgently to maintain the Service or for security, in which case we will publish it as soon as practicable. The Customer may subscribe to notifications of changes by contacting us at the address in clause 13.5.
6.3 The Customer may object to a new Sub-processor on reasonable grounds relating to data protection by notice to us within 14 days of publication. We will discuss the objection in good faith. If we cannot resolve it within 30 days, the Customer may terminate the Terms by deleting its Account, and clause 24.3 of the Terms applies as if we had terminated under clause 24.2(b).
6.4 We will impose on each Sub-processor, by written contract, data protection obligations that provide at least the level of protection required by this Addendum, and we remain responsible to the Customer for the performance of each Sub-processor's obligations.
6.5 Merchants, websites, Connected Services, recipients and other third parties with which Sundae deals on the Customer's Instructions are not Sub-processors. They are independent controllers chosen by the Customer.
7. International transfers
7.1 We process Customer Personal Data in the United Kingdom and the European Economic Area, and our Sub-processors process it in the countries stated in Schedule 1 to the Privacy Policy, including the United States.
7.2 Where we or a Sub-processor transfer Customer Personal Data to a country outside the United Kingdom that is not covered by UK adequacy regulations, we will ensure that the transfer is protected by an appropriate safeguard under Data Protection Law, being: (a) the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified; or (b) the International Data Transfer Agreement issued by the Information Commissioner, or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, in each case together with any supplementary measures we consider necessary. The Customer authorises those transfers and will, on request, execute any document reasonably required to give effect to the safeguard.
7.3 Transfers of Customer Personal Data to Merchants, websites, Connected Services and recipients in carrying out Instructions are transfers made by the Customer, at its instruction, and the Customer is responsible for ensuring they are lawful.
8. Assistance and data subject requests
8.1 If we receive a request from a data subject, a supervisory authority or any other person relating to Customer Personal Data, we will, where legally permitted, pass it to the Customer promptly and will not respond except to acknowledge receipt, to direct the person to the Customer, or as the Customer instructs or the law requires.
8.2 Taking into account the nature of the processing, we will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to requests by data subjects to exercise their rights. The Customer acknowledges that we cannot access the contents of the Vault, that memory and conversation data can be deleted by the Customer through the Service, and that Customer Personal Data shared with third parties on the Customer's Instructions is beyond our control.
8.3 Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to the Customer with its obligations relating to security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.
8.4 We may charge the Customer a reasonable fee for assistance under this clause 8 that goes beyond what the Service ordinarily provides, or that results from the Customer's own breach of Data Protection Law.
9. Personal data breaches
9.1 We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, using the contact details associated with the Customer's Account, and will provide such information about the breach as we have and as the Customer reasonably requires to meet its own notification obligations, as that information becomes available.
9.2 A notification under clause 9.1 is not an acknowledgement of fault or liability.
9.3 The Customer is responsible for notifying supervisory authorities and data subjects where Data Protection Law requires it, and will not identify us in any notification without first consulting us, unless the law requires it.
10. Deletion and return
10.1 The Customer may export its data from the Service to the extent the Service permits, and must do so before deleting its Account.
10.2 On termination of the Terms or deletion of the Customer's Account, we will delete Customer Personal Data, or render it unreadable, within the periods set out in clause 8 of the Privacy Policy, except to the extent we are required by law to retain it, in which case we will continue to protect it under this Addendum and will not process it for any other purpose.
10.3 On the Customer's written request we will confirm in writing that deletion has taken place.
11. Audit and information
11.1 We will make available to the Customer the information reasonably necessary to demonstrate compliance with this Addendum, by responding in writing to reasonable written questions not more than once in any 12-month period.
11.2 Where Data Protection Law requires it, or following a personal data breach affecting the Customer's data, and where the information under clause 11.1 is insufficient, the Customer or an independent auditor appointed by it and bound by confidentiality may audit our compliance with this Addendum, subject to: at least 30 days' written notice; conduct during normal business hours; a scope agreed in advance; no access to data of other customers, to our Sub-processors' premises or systems, or to information protected by legal privilege; no more than one audit in any 12-month period; and the Customer bearing all costs, including our reasonable costs of supporting the audit.
12. Liability
12.1 Each party's liability arising out of or in connection with this Addendum is subject to the exclusions and limitations in clause 26 of the Terms, which apply to this Addendum as if set out in it, and our aggregate liability under the Terms and this Addendum together shall not exceed the cap in clause 26.4 of the Terms.
12.2 Nothing in this Addendum limits either party's direct liability to data subjects or supervisory authorities under Data Protection Law.
13. General
13.1 This Addendum continues for as long as we process Customer Personal Data, and clauses 10, 12 and 13 survive its termination.
13.2 We may update this Addendum from time to time as described in clause 23.2 of the Terms, including to reflect changes to Data Protection Law, to our Sub-processors or to the Service. Where Data Protection Law requires additional or different terms, the parties will agree them in good faith.
13.3 This Addendum, its subject matter and its formation, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
13.4 Clauses 30 (General) and 31 (Governing law and jurisdiction) of the Terms apply to this Addendum.
13.5 Notices to us under this Addendum should be sent by post to Sundae Bar AI PLC, c/o Druces LLP, 6th Floor, 99 Gresham Street, London EC2V 7NG, United Kingdom. Notices to the Customer may be sent to the contact details associated with its Account.
Annex 1: Details of processing
This Annex describes the processing of Customer Personal Data under this Addendum.
| Subject matter | The provision of the Service, an AI personal assistant that carries out tasks on the Customer's Instructions inside an Environment allocated to the Customer, as described in the Terms. |
| Duration | For as long as the Customer holds an Account, and thereafter until deletion under clause 10. |
| Nature of the processing | Collection, storage, organisation, retrieval, use, transmission to AI models and other Sub-processors, disclosure to Merchants, websites, Connected Services and recipients on Instructions, generation of Output, hosting, and deletion. |
| Purpose of the processing | To interpret and carry out the Customer's Instructions, to remember facts the Customer provides, to operate the Vault, Hand-over, email, hosting, reminders and Connected Services features, and to improve the Service as the Customer instructs under clause 3.2(d). |
| Categories of data subjects | The Customer's personnel who use the Service; the Customer's customers, clients, suppliers, contacts, guests and other individuals whose data the Customer provides to or retrieves through the Service; recipients of email and messages sent by Sundae; and visitors to Hosted Content. |
| Categories of personal data | Names, contact details, addresses, messages and correspondence, calendar and scheduling data, documents and files, booking and order details, payment-related details where the Customer stores them in the Vault (encrypted and unreadable by us) or types them during a Hand-over (not stored by us), account credentials and tokens for Connected Services, memory facts, and any other personal data the Customer chooses to include in Instructions or Content. |
| Special category and criminal offence data | None intended. Any such data the Customer includes is processed only on the Customer's instruction and the Customer must have a lawful basis under Articles 9 and 10 of the UK GDPR. |
| Sub-processors | As listed in Schedule 1 to the Privacy Policy, as updated from time to time. |
Annex 2: Technical and organisational measures
The measures below are those in place as at the Effective Date. They are appropriate to a beta Service designed for personal use and may be updated under clause 5.1.
1. Isolation: each Account is allocated its own Environment (a separate Linux container with its own browser, file storage, memory and email address) on servers in Germany. Environments are not shared between Accounts.
2. Encryption in transit: connections between users, the Service, Sub-processors and the Environment use TLS.
3. Vault encryption: Vault Items are encrypted on the user's device with keys derived from the user's passkey. Our servers hold ciphertext and item metadata only. We hold no key capable of decrypting Vault Items.
4. Clean-room filling: decrypted Vault values are entered into the browser by a separate privileged process. The AI model, conversation history, memory and logs do not receive them.
5. Payment controls: a per-transaction Spending Limit enforced in code before an approval request is sent; passkey approval required for each Vault payment and for raising or removing the limit; refusal of cryptocurrency exchanges, wallets and bridges.
6. Redaction: card numbers, one-time codes and passwords are removed from conversation data where detected before storage.
7. Consequential actions: sending, publishing, deleting irrecoverable data, creating or changing accounts, and actions through Connected Services are designed to run only after the user's confirmation, checked in code for Connected Services and payments.
8. Untrusted content handling: content from web pages, email and documents is filtered and fenced before being presented to the AI model, and is treated as data rather than instructions.
9. Email controls: Sundae sends email only to recipients on a user-approved list and only on the user's request or approval of an exact draft.
10. Access control: access to conversation content is restricted to personnel who need it for legality, safety, troubleshooting or support, and each access is logged.
11. Monitoring without content: logs, error reports and usage events sent to monitoring and analytics providers exclude message text.
12. Limited retention: a rolling 30-day redacted admin log; deletion or rendering unreadable of Account data on deletion of the Account; retention periods as set out in the Privacy Policy.
13. Sub-processor contracts: written contracts with each Sub-processor containing data protection obligations and, where relevant, international transfer safeguards.
14. Incident response: a process for identifying, assessing, containing and notifying personal data breaches.
15. User self-service: users can delete Vault Items, ask Sundae to forget facts, revoke Connected Services, disable the Vault, lower or freeze the Spending Limit and delete their Account without contacting us.