ANNEX IIb: DESCRIPTION OF PROCESSING -AI Smart Notifications

Categories of data subjects whose personal data is processed

The data subjects under this Annex are the data controller's employees who areusers of the AI Smart Notifications feature.

Categories of personal data processed

User ID and behavioural data linked to a user ID, reflecting how a user interacts with notificationsover time, drawing on up to 90 days of history.

The feature does not process the content or text of notifications, and does not process demographic, profile, or special category data.

The data controller and the data processor have agreed that sensitive data will not be processed under this agreement. The data controller commits to omit sensitive data from the platform.

Nature of the processing

Collection,structuring, analysis, and storage of notification engagement data through the AI Smart Notifications feature.

Theprocessor retains a user's notification history for up to 90 days, used totrain and retrain the underlying model on a recurring basis (approximately weekly).

On instruction from the data controller, including on a data subject's request,the processor will delete or stop processing that user's personal data. Data already used to train a version of the model cannot be deleted from it and exists only as aggregated statistical information within the model.

Purpose(s) for which the personal data is processed on behalf of the controller

The purpose of the data processing is to provide the data subjects with access to the AI Smart Notifications feature.

The purpose is also to train and improve the AI model, solely to develop and enhance such AI-powered features for the benefit of the datacontroller and its data subjects. Such processing will not be used for any purpose beyond the improvement of services provided to the data controller.

Additionally the purpose is to evaluate adoption and usage of the AI Smart Notifications feature internally.

Duration of the processing

Processing continues during the contractual relationship between the data controller and Relesys, for as long as the AI Smart Notifications feature remains enabled for the account, including the model's recurring retraining cycle.

‍

‍

‍