xAI Data Processing Addendum

Last Modified: September 5, 2024

This Data Processing Addendum, including its Appendices (the "DPA"), is incorporated into and forms part of the Enterprise Terms of Service that govern your use of Grok and any and all related products, software, documentation, and online, mobile-enabled, and/or digital services (the "Agreement"). This DPA sets out the terms that apply when xAI processes Customer Data (as defined below) on your behalf in connection with the Service, including any Customer Data that you provide to xAI through our API or other business services.

You enter into this DPA on behalf of yourself and, to the extent required under Applicable Data Protection Laws, in the name and on behalf of your affiliates permitted to use the Service under the Agreement. If and to the extent the terms of this DPA conflict with the terms of the Agreement, the terms of this DPA shall control. Unless otherwise defined herein, capitalized terms used in this DPA have the same meaning given to them under the Agreement.

1. Definitions

   1. "Applicable Data Protection Laws" means all data protection and privacy laws and regulations applicable to the processing of Customer Data, which may include European Data Protection Laws and U.S. Privacy Laws.

      2. "Customer Data" means Personal Data that you provide to xAI in connection with the Service and that we process on your behalf, as described in Appendix 1.

         3. "Europe" means the European Economic Area and its Member States, Switzerland, and the United Kingdom ("UK").

         4. "European Data Protection Laws" means all data protection and privacy laws and regulations of Europe, as applicable to the processing of Customer Data, including (i) the General Data Protection Regulation 2016/679 ("GDPR"); (ii) the GDPR as it forms part of UK law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 (together, "UK GDPR"); and (iii) the Swiss Federal Act on Data Protection Act of 2020 and its Ordinance ("Swiss FADP"); as may be amended, superseded, or replaced.

         5. "Personal Data" has the meaning assigned to the term “personal data” or “personal information” under Applicable Data Protection Laws

         6. "Restricted Transfer" means a transfer of Customer Data originating from Europe to a country that does not provide an adequate level of protection for personal data within the meaning of applicable European Data Protection Laws.

         7. "Security Incident" means a breach of xAI's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data in connection with the Service. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

         8. "SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021, as may be amended, superseded, or replaced.

         9. "Subprocessor" means any third-party processor engaged by xAI to process Customer Data in order to provide the Service. Subprocessors do not include xAI's employees, contractors, or consultants.

         10. "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018, as may be amended, superseded, or replaced.

         11. "U.S. Privacy Laws" means all federal and state data protection and privacy laws and regulations of the United States, as applicable to the processing of Customer Data, including (i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.), and its implementing regulations ("CCPA"); (ii) the Virginia Consumer Data Protection Act (VA Code Ann. §§ 59.1-575 et seq.) ("VCDPA"); (iii) the Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 et seq.) and its implementing regulations ("CPA"); (iv) the Connecticut Data Privacy Act (Pub. Act No. 22015) ("CTDPA"); and (v) the Utah Consumer Privacy Act (Utah Code Ann. §§ 13-61-101 et seq.) ("UCPA"); in each case when effective and as may be amended, superseded, or replaced.

         12. The terms "controller", "data subject", "personal data", "process", "processing", "processor", and "supervisory authority" have the meanings given to them under Applicable Data Protection Laws.

2. Processing of Personal Data

   1. Scope and Roles. This DPA applies to the extent that we process Customer Data on your behalf in connection with the provision of the Service under the Agreement. The parties acknowledge and agree that xAI is a processor and you are a controller or processor of Customer Data, as applicable, under Applicable Data Protection Laws.

   2. Details of Processing. The subject matter, duration, nature, and purpose of the processing of Customer Data, and the types of Personal Data and categories of data subjects, are described in Appendix 1.

   3. Your Responsibilities. You shall, in your use of the Service:

      1. comply with your obligations under Applicable Data Protection Laws, including (i) ensuring that your processing instructions to xAI comply with Applicable Data Protection Laws; and (ii) obtaining all necessary rights, consents, and authorizations required to provide Customer Data to xAI and allow us to process Customer Data as contemplated by the Agreement;

         2. without prejudice to our security obligations under Section 5.1 (Security Measures), use the Service in a secure manner, including by (i) securing your account authentication credentials; (ii) ensuring the security of systems and devices used to access the Service; and (iii) backing up or retaining copies of Customer Data as appropriate; and

         3. if you are a processor of Customer Data, (i) warrant that the relevant controller has authorized your engagement of xAI as another processor and approved your processing instructions to us; and (ii) remain responsible for any communications, notifications, assistance, and/or authorizations that may be required in connection with the processing of Customer Data.

   4. xAI’s Responsibilities. We shall comply with our obligations under Applicable Data Protection Laws in our role as a processor and inform you if we cannot or can no longer meet such obligations. As a processor, we agree to:

      1. process Customer Data solely in accordance with your lawful and documented processing instructions, where such instructions are consistent with the terms of the Agreement;

         2. inform you if, in our reasonable opinion, your processing instructions infringe Applicable Data Protection Laws;

         3. if Customer Data is subject to U.S. Privacy Laws, not (i) "sell" or "share" Customer Personal Data (as defined by the CCPA or equivalent concepts under U.S. Privacy Laws); (ii) retain, use, disclose, or otherwise process Customer Data outside of our direct business relationship; or (iii) combine Customer Data with Personal Data collected or received from or on behalf of any third party; except to the extent necessary to provide the Service or otherwise permitted by U.S. Privacy Laws; and

         4. if you permit or instruct us to process Customer Data in a deidentified, anonymized, and/or aggregated form, (i) adopt reasonable measures to prevent such information from being used to infer information about, or otherwise being linked to, a particular data subject; (ii) not attempt to reidentify such information except to determine that the information has been effectively deidentified in accordance with Applicable Data Protection Laws; and (iii) contractually obligate any recipients of such information to comply with the requirements of this provision.

   5. No Assessment of Compliance. Notwithstanding the foregoing, xAI is not responsible for monitoring your compliance with applicable laws or determining if your processing instructions are compliant with applicable laws. Furthermore, we have no obligation to assess Customer Data in order to identify information that is subject to specific legal requirements.

3. Subprocessors

   1. Appointment of Subprocessors. You agree and provide a general written authorization that xAI may engage Subprocessors to process Customer Data. xAI's list of Subprocessors is available here ("Subprocessor List"). xAI shall (a) enter into a written agreement with each Subprocessor containing data protection obligations that are substantially the same as those in this DPA; and (b) remain liable for any acts or omissions of our Subprocessors that causes us to breach our obligations under this DPA.

   2. Changes to Subprocessors. If you subscribe to receive email notifications as provided on our Subprocessor List, where available, then xAI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect. You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice. Such notice shall explain the reasonable grounds for the objection. The parties shall discuss the objections in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, xAI will, at its sole discretion, either not appoint the Subprocessor or permit you to terminate the affected part of the Service in accordance with the termination provisions under the Agreement without liability to either party (but without prejudice to any fees incurred by you prior to such termination). This termination right is your sole and exclusive remedy if you object to any new or replacement Subprocessor. If you do not exercise your right to object in the terms defined above, your silence shall be deemed to constitute an approval of such engagement.

4. Confidentiality

   1. Confidentiality. We shall ensure that any persons authorized to process Customer Data are subject to a duty of confidentiality that survives the termination of their employment and/or contractual relationship.

   2. Government Requests. We shall not disclose Customer Data to any law enforcement agency or government authority (collectively, "Government Authority") unless instructed by you or as necessary to comply with applicable laws or a valid and binding order of a Government Authority, such as a subpoena or court order. If a Government Authority requests access to Customer Data, and unless legally prohibited from doing so, we shall (a) inform the Government Authority that xAI is a processor and attempt to redirect the Government Authority to you (and we may provide your basic contact information to the Government Authority for such purposes); or (b) in the event such redirection is not possible, notify you of the request to allow you to seek a protective order or other appropriate remedy. If we are legally compelled to respond to the request, we shall review the legality of the request and determine whether the request may be challenged. In any event, we shall only disclose the minimum information required to comply with the request.

5. Security

   1. Security Measures. We shall implement and maintain reasonable technical and organizational measures, as appropriate to the processing of Customer Data, that are designed to protect the security, confidentiality, integrity and availability of Customer Data and protect against Security Incidents, as further described in Appendix 2 ("Security Measures"). We may update or modify the Security Measures from time to time provided that such updates and modifications do not materially decrease the overall security of the Service.

   2. Audits and Security Certifications. Upon written request, and subject to reasonable notice and confidentiality agreements, we shall provide you with access to reasonably requested documentation to demonstrate our compliance with this DPA, including providing copies of any certifications, audit reports, and/or other relevant documentation. Where appropriate, we may instead make available a summary of the results of third-party certifications and/or audits relevant to our compliance with this DPA.

   3. Incident Notification. We will notify you without undue delay after we become aware of any Security Incident for which notification is required under Applicable Data Protection Laws. Such notification will describe the nature of the Security Incident and include other relevant information that we are reasonably able to disclose, taking into account the nature of the Service, the information available to us, and any restrictions on disclosing the information (such as confidentiality). Any notification that we provide relating to Security Incidents shall not be construed as an acknowledgement by xAI of any fault or liability.

6. Data Subject Rights Requests

   1. To the extent required under Applicable Data Protection Laws and taking into account the nature of the Service, and insofar as you cannot respond using functionality made available through the Service, we shall provide you with reasonable assistance to enable you to respond to requests from data subjects seeking to exercise their rights under Applicable Data Protection Laws. In the event that we receive such requests from data subjects directly, we will promptly notify you and not respond directly to the data subject without your prior written authorization, except to inform the data subject that we are a processor and direct them to contact you.

7. Data Protection Impact Assessments

   1. Upon reasonable written request, and to the extent required under Applicable Data Protection Laws, we shall, considering the nature of the processing and the information available to xAI, provide you with reasonable cooperation and assistance necessary to fulfill your obligation to carry out data protection impact assessments and consult with supervisory authorities related to your use of the Service. We shall comply with the foregoing by (i) complying with Section 5.2 (Audits and Security Certifications); (ii) providing the information contained in the Agreement (including this DPA); or (iii) upon request, if the information provided under sub-sections (i) and (ii) is insufficient for you to fulfill such obligations, providing additional reasonable cooperation and assistance.

8. International Data Transfers

   1. International Data Transfers. You acknowledge and agree that xAI may transfer and process Customer Data outside Europe as necessary to provide the Service, including the United States and other countries where xAI and its Subprocessors maintain data processing operations. We shall take all such measures as are necessary to ensure such transfers are made in compliance with Applicable Data Protection Laws.

   2. Standard Contractual Clauses. To the extent that your transfer of Customer Data to xAI involves a Restricted Transfer, the SCCs shall be incorporated and form an integral part of the DPA as follows:

      1. EU Transfers. In relation to Customer Data that is subject to the GDPR: (i) Module Two (Controller to Processor) or Module Three (Processor to Processor) shall apply, as applicable; (ii) in Clause 7, the optional docking clause shall apply; (iii) in Clause 9, Option 2 shall apply and the time period for prior notice of Subprocessor changes is set out in Section 3.2) Changes to Subprocessors); (iv) in Clause 11, the optional language shall not apply; (v) in Clause 17, Option 1 shall apply and the SCCs shall be governed by the laws of the Republic of Ireland; (vi) in Clause 18(b), disputes shall be resolved before the courts of the Republic of Ireland; and (vii) Annexes I and II of the SCCs shall be deemed completed with the information set out in Appendices 1 and 2 of this DPA respectively.

         2. UK Transfers. In relation to Customer Data that is subject to the UK GDPR, the SCCs shall apply in accordance with Section 8.2(a) (EU Transfers) and as modified by the UK Addendum, which shall be deemed executed by the parties and incorporated into and form an integral part of this DPA. Any conflict between the SCCs and the UK Addendum shall be resolved in accordance with Sections 10 and 11 of the UK Addendum. Tables 1 to 3 of the UK Addendum shall be deemed completed with the information set out in Appendices 1 and 2 of this DPA respectively, and Table 4 shall be deemed completed by selecting "neither party".

         3. Swiss Transfers. In relation to Customer Data that is subject to the Swiss FADP, the SCCs shall apply in accordance with Section 8.2(a) (EU Transfers) and the following modifications: (i) references to "Regulation (EU) 2016/679" and specific articles therein shall be replaced with references to the Swiss FADP and the equivalent articles or sections therein; (ii) references to "EU", "Union" and "Member State" shall be replaced with references to "Switzerland"; (iii) the competent supervisory authority shall be the Swiss Federal Data Protection Information Commissioner; (iv) references to the "competent supervisory authority" and "competent courts" shall be replaced with references to the "Swiss Federal Data Protection Information Commissioner" and "applicable courts of Switzerland"; and (v) the SCCs shall be governed by the laws of Switzerland and disputes shall be resolved before the applicable courts of Switzerland.

9. Return and Deletion of Customer Data

   1. Upon termination of the Agreement, we shall delete any Customer Data in our possession in accordance with the Agreement, except to the extent that we are required to retain copies under applicable laws, in which case we shall isolate and protect such Customer Data from any further processing except to the extent required by applicable laws. For clarity, xAI may continue to process information derived from Customer Data that you have instructed us to deidentify, anonymize, and/or aggregate such that the data is no longer considered personal data under Applicable Data Protection Laws.

10. General Provisions

    1. Legal Effect; Term. This DPA is an addendum to and incorporated into the Agreement. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. This DPA supersedes and replaces all prior or contemporaneous representations, understandings, agreements, or communications between the parties, whether written or verbal, regarding the subject matter of this DPA, including any data processing addenda previously entered into between the parties. This DPA shall continue in force until the termination of the Agreement and so long as xAI continues to process Customer Data on your behalf.

    2. Limitation of Liability. The liability of each party under this DPA (including the SCCs) shall be subject to the exclusions and limitations of liability set out in the Agreement. In no event does this DPA restrict or limit the rights of any data subject under Applicable Data Protection Laws.

    3. Disclosure of this DPA. You acknowledge that xAI may disclose this DPA and any relevant privacy provisions of the Agreement to a supervisory authority or other judicial or regulatory body upon request.

    4. Changes to this DPA. We may, in our sole discretion, modify or update this DPA from time to time, and so you should review this page periodically. When we change this DPA in a material manner, we will update the ‘last modified’ date at the top of this page and notify you that material changes have been made to this DPA. Your continued use of the Service after any change to this DPA constitutes your acceptance of the new DPA. If you do not agree to any part of this DPA or to any future DPA, do not access or use (or continue to access or use) the Service.

    5. Governing Law. This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions of the Agreement, unless otherwise required by this DPA or Applicable Data Protection Laws.

Appendix 1: Description of the Processing

This Appendix describes the processing of Customer Data by the parties in connection with the Service and forms an integral part of the Agreement. Unless otherwise defined herein, capitalized terms in this Appendix have the same meaning ascribed to them in the Agreement.

(A) List of parties

(B) Description of the transfer

(C) Competent supervisory authority

For the purposes of the SCCs, the competent supervisory authority shall be determined in accordance with the GDPR.

Appendix 2: Security Measures

This Appendix describes the technical and organizational measures implemented by xAI to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and forms an integral part of the Agreement. Unless otherwise defined herein, capitalized terms in this Appendix have the same meaning ascribed to them in the Agreement.

The following table provides examples of the technical and organizational measures implemented by xAI.