Data Processing Addendum (DPA)

Bilan AI (operated by Dependable Property LLC). Last updated: June 2026.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Dependable Property LLC ("Bilan AI", "Processor") and the customer ("Customer", "Controller") and applies to the processing of Personal Data by Bilan AI on behalf of the Customer. Where the GDPR, UK GDPR, or similar laws apply, this DPA governs such processing.

1. Roles of the parties

For Personal Data that the Customer submits to the Service about its own clients, employees, and contacts, the Customer is the Controller and Bilan AI is the Processor. Bilan AI is a Controller only for limited account-administration data described in the Privacy Policy.

2. Processing details

Subject matter: provision of the cloud accounting/ERP Service. Duration: the term of the subscription plus any retention required by law. Nature & purpose: hosting, storage, and processing of Customer Data to deliver the Service. Data subjects: the Customer's clients, vendors, employees, and contacts. Categories of data: contact details, financial and accounting records, and other data the Customer chooses to input.

3. Processor obligations

• Process Personal Data only on the Customer's documented instructions, including this DPA and use of the Service;
• Ensure personnel authorized to process Personal Data are bound by confidentiality;
• Implement appropriate technical and organizational security measures (Section 7);
• Assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations;
• Notify the Customer without undue delay after becoming aware of a Personal Data breach;
• At the Customer's choice, delete or return Personal Data at the end of the engagement, subject to legal retention requirements;
• Make available information reasonably necessary to demonstrate compliance and allow for audits, subject to confidentiality and reasonable notice.

4. Subprocessors

The Customer authorizes Bilan AI to engage the subprocessors listed at /subprocessors. Bilan AI imposes data-protection obligations on subprocessors consistent with this DPA and remains responsible for their performance. Bilan AI will provide notice of new subprocessors and a reasonable opportunity to object.

5. International transfers

Where Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, such transfers are made under the applicable Standard Contractual Clauses, which are incorporated by reference into this DPA.

6. Data-subject rights

Bilan AI will, to the extent legally permitted, promptly inform the Customer of requests from data subjects and will assist the Customer in fulfilling its obligations to respond.

7. Security measures (Annex)

• Encryption of data in transit (TLS) and access controls on data at rest;
• Role-based access control and multi-tenant data isolation (each company's data is scoped and isolated);
• Least-privilege administrative access and audit logging of sensitive actions;
• Secure, SOC 2-aligned hosting infrastructure and regular backups;
• Vulnerability management and change-control processes.

8. Execution

To execute a countersigned copy of this DPA for your organization, contact support@aibilan.com.