PLCs.ai
PLCs.ai
The PlatformAutomation ContextPricingTrust & SecurityBlogDeveloperLog in
Start free trial
Legal

Data Processing Addendum

Version 1.5 · Effective date: June 10, 2026 · PLCs.ai, Inc. · Hoboken, NJ

This Data Processing Addendum (“Addendum”) is entered into by and between PLCs.ai, Inc., a Delaware corporation with offices at Suite 400, 258 Newark Street, Hoboken, New Jersey 07030, United States (collectively, the “Company”) and the company, entity, or individual identified in the applicable Order or account registration for the provision of the Company's service (“Customer”).

WHEREAS, the Company may be involved in processing certain personal data or personal information from PLC files and related content only on behalf of Customer as part of its PLCs.ai platform, including the cloud-based web application known as plcsai-cloud, the desktop application known as the PLCs.ai Companion App, and our website at plcs.ai (the “Service”), pursuant to a “Customer Agreement” between Customer and the Company, which includes our Terms of Service incorporated within and/or an Order (the “Terms”), and the parties wish to regulate the Company's processing of such personal data, through this Addendum.

THEREFORE, the parties have agreed to this Addendum, consisting of these parts:

PartIs it applicable and in force?

Part One – General provisions

Always applies and is in force for Services, to the extent that the Service provided by the Company will involve the processing of individuals’ personal data.

Part Two – EU/EEA or UK GDPR DPA

Only if the Customer is subject to the UK or EU/EEA GDPR regarding the personal data that the Company processes for it when providing the Services.

Part Three – State Privacy Laws in the U.S.

Only if the Customer is subject to state privacy laws in the United States of America and specific US State Privacy Laws regarding the personal data that the Company processes for it when providing the Services.

1.

General Provisions

1.Scope
This Addendum and any of its Parts apply only to the extent that the Service provided by the Company will involve the processing of individuals' personal data, on behalf of the Customer and based on the Customer's instruction. It does not apply to any data collected from prospects, website visitors, and account administrators, or for the Company's processing of data to administer the business or contractual relationship between the Company and the Customer, as further detailed in our Privacy Policy.
2.Order of Precedence
In the event of any conflicting provisions between this Addendum and the Terms or any other terms in place between the parties, the provisions of this Addendum shall prevail.
3.Data Security
Considering the methods, the costs of implementation and the nature, scope, context and purposes, the Company will implement and maintain reasonable security procedures and practices appropriate to the nature of the personal data, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure (including data breaches).
4.Data Subject Requests
The Company will follow reasonable Customer's written instructions to accommodate data subjects' requests to exercise their rights in relation to their information within the personal data, including accessing their data, correcting it, restricting its processing or deleting it. The Company will pass on to Customer requests that it receives (if any) from data subjects regarding their information processed by the Company. The Company shall notify Customer of the receipt of such request without undue delay, together with the relevant details.
5.Return or Deletion of Information
Upon Customer's written request where no subsequent further processing is required, the Company shall, at the instruction of Customer, either delete, destroy or return to Customer, some or all (however instructed) of the personal information that it and its third party suppliers process for Customer. Upon Customer's request, the Company will furnish written confirmation that the personal data has been deleted or returned pursuant to this section.
6.Disclosure
Unless legally prohibited, the Company will provide Customer prompt notice of any request it receives from authorities to produce or disclose personal data it has Processed on Customer's behalf, so that Customer (or its customer) may contest or attempt to limit the scope of production or disclosure request.
7.Data Breaches
The Company shall without undue delay notify Customer of any actual or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, that it becomes aware of. The Company will investigate the breach, and take all available measures to mitigate the breach and prevent its reoccurrence. The Company will cooperate in good-faith with Customer on issuing any statements or notices regarding such breaches, to authorities and data subjects. Notices under this Section are sent to the owner(s) of Customer's organization in the Service and include, as they become available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.
8.Subcontracting to Suppliers
Customer authorizes the Company to subcontract any of its Service related activities consisting of the processing of the personal data or requiring personal data to be processed by any third party supplier without the prior written authorization of Customer provided that: (a) the Company shall ensure that the third party is bound by similar obligations under this Part 1; and (b) the Company is liable to Customer for the performance of any such third party that fails to fulfil its obligations.
9.Details of Processing
The nature and purposes of the Processing activities, categories of data subjects whose personal data may be processed, categories of personal data Processed, frequency of the Processing, the period for which the personal data will be retained and (sub-)processors list are all specified in Appendix A of this Addendum, per each type of Service.
10.Confidentiality
The Company will ensure that its staff authorized to process the personal data are contractually bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
11.Disputes
Any dispute that the parties are unable to amicably resolve under this Addendum, shall be subject to the sole and exclusive jurisdiction and venue specified in the Terms.
12.Liability
Each party's total and aggregate liability to the other party under this Addendum for any direct or indirect damages asserted in connection with this Addendum, whether in tort (including negligence), contract, indemnity, strict liability, or otherwise, is capped as specified in the Terms, and in the absence of such specification to the sum of fees paid by the Customer to the Company in the last 12 months before any claim.
2.

EU/EEA or UK GDPR DPA

1.Definitions
Capitalized terms used in this Part 2 but not defined herein or in the Terms shall have the meaning ascribed to them in the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) applicable as of 25 May 2018 and any national law supplementing the GDPR, and the UK Data Protection Act 2018 under the European Union (Withdrawal) Act 2018 as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419); these shall collectively be referred to in this Part 2 as “Data Protection Law”.
2.Roles and Instructions
Customer commissions, authorizes and requests that the Company Process the personal data based on the instructions of Customer. Unless agreed otherwise in the Terms, the Company will Process the Personal Data only on Customer's behalf (it being understood that Customer may be acting as a Processor for and on behalf of its Customer, the Controller). The Company and Customer are each responsible for complying with the Data Protection Law as applicable to their roles.
3.Processing Instructions
The Company will Process the Personal Data only based on instructions from Customer documented in this Addendum or otherwise provided in writing, which instructions must be consistent with the nature and characteristics of the Services. The foregoing applies unless the Company is otherwise required by law to which it is subject (and in such a case, the Company shall inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest). The Company shall promptly inform Customer if, in the Company's opinion, an instruction is in violation of Data Protection Law.
4.Compliance Information
The Company will make available to Customer all information at its disposal necessary to demonstrate compliance with the obligations under Data Protection Law.
5.Records and Article 30
Upon written request of the Customer and within reasonable time, the Company will make available to Customer all information in its disposal necessary to demonstrate compliance with the obligations under Data Protection Law, shall maintain all records required by Article 30(2) of the GDPR, and shall make them available to the Customer upon request.
6.Data Subject Rights
The Company will follow Customer's instructions to accommodate Data Subjects' requests to exercise their rights in relation to their Personal Data, including accessing their data, correcting it, restricting its processing or deleting it, within the boundaries of the Service's capabilities and features. The Company will pass on to Customer requests that it receives from Data Subjects regarding their Personal Data Processed by the Company. Any request from Data Subjects arising out of the processing of Personal Data by the Company, including but not limited to rectification, erasure, and blocking of Personal Data, portability requests and objection, has to be asserted to Customer. Customer is solely liable for responding to Data Subjects on such requests and notifying Company of such requests, where applicable.
7.Sub-Processors
Customer authorizes the Company to engage another sub-processor for carrying out specific processing activities, provided that the Company informs Customer at least 10 business days in advance of any new or substitute sub-processor, in which case Customer shall have the right to object, on reasoned grounds, to that new or replaced sub-processor. If Customer so objects, the Company may not engage that new or substitute sub-processor for the purpose of Processing Personal Data, and the Company may either select another sub-processor in which case the above procedure shall repeat, or if it so chooses, terminate the license and the Terms with no liability to Customer for such premature termination.
8.Sub-Processor Obligations
Without limiting the foregoing, in any event where the Company engages another sub-processor, the Company will ensure that similar data protection obligations as set out in this Addendum are likewise imposed on that other sub-processor by way of a contract, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where the other sub-processor fails to fulfil its data protection obligations, the Company shall remain fully liable to Customer for the performance of that other sub-processor's obligations.
9.Data Transfers
The Company and its other sub-processors will only Process the Personal Data in member states of the European Economic Area, in territories or territorial sectors recognized by an adequacy decision of the European Commission (or as applicable, the UK GDPR regulations), as providing an adequate level of protection for Personal Data pursuant to Article 45 of the GDPR or using adequate safeguards as required under Data Protection Law governing cross-border data transfers (e.g., Standard Contract Clauses).
10.Audits
Subject to prior coordination between the Customer and the Company as to the timing and agenda of the audit, following Customer's written request, the Company shall allow within reasonable timeframe for and contribute to audits, including carrying out inspections conducted by Customer, the Controller, or another auditor mandated by Customer or the Controller in order to establish the Company's compliance with this Addendum and the provisions of the applicable Data Protection Law as regards the Personal Data that the Company processes on behalf of Customer. Such audits or inspections shall be carried out during the Company's ordinary business hours, not more than one business day per year (unless Data Protection Law or a supervisory authority mandate more frequent audits or inspections), shall be conducted with minimal disruption to the Company's business activities, and be subject to confidentiality undertakings satisfactory to the Company.
11.Data Privacy Impact Assessments
The Company will assist, within a reasonable scope of assistance, Customer with the preparation of data privacy impact assessments and prior consultation as appropriate (and if needed).
3.

State Privacy Laws in the U.S.

1.Definitions
"Applicable State Privacy Laws"

means the CPRA and other applicable state privacy laws in the United States, such as (but not limited to): Virginia Consumer Data Protection Act, Connecticut Act Concerning Personal Data Privacy and Online Monitoring, Utah Consumer Privacy Act, and the Colorado Privacy Act.

"Breach"

means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Covered Information, during its Processing by the Company.

"Consumer"

means a natural person, including a natural person in their professional or work capacity.

"CPRA"

means Cal. Civ. Code §1798.100 et seq. and the regulations at 11 C.C.R. §7000 et seq.

"Covered Information"

means information that the Company's Service stores, handles, or otherwise maintains for and on behalf of Customer.

"Process"

(and its cognate terms) means any operation or set of operations that are performed on Covered Information or on sets of Covered Information, whether or not by automated means.

"Sell"

(and its cognate terms) means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Covered Information for monetary or other valuable consideration.

"Share"

(and its cognate terms) means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Covered Information for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions for cross-context behavioral advertising in which no money is exchanged.

2.Permitted Processing
The Company may only Process the Covered Information to perform the Terms. The parties agree that the Customer is only disclosing the Covered Information to the Company so that the Company can provide the Services to the Customer and other purposes agreed upon in the Terms. The Company is prohibited from retaining, using, or disclosing the Covered Information for any commercial purpose other than the foregoing business purposes. Additionally, subject to the Terms, the Company is prohibited from retaining, using, or disclosing the Covered Information pursuant to this Addendum outside the direct business relationship between the Company and Customer.
3.No Sale or Sharing
Subject to the Terms, the Company must not Sell or Share any Covered Information it Processes.
4.Compliance with State Laws
The Company shall comply with all applicable sections of the Applicable State Privacy Laws and shall provide, with respect to Covered Information, the same level of privacy protection as required by Applicable State Privacy Laws.
5.Consumer Requests
Commensurate with the nature of the Company's Services to Customer and in accordance with Customer's specified instructions to the Company, the Company shall help Customer within a reasonable timeframe to comply with Consumer written requests made pursuant to Applicable State Privacy Laws of which the Company is informed of by Customer.
6.Customer Oversight Rights
The Company grants Customer the right to take reasonable and appropriate steps to ensure that the Company uses the Covered Information in a manner consistent with Customer's obligations under this Addendum and Applicable State Privacy Laws. The Company grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate the Company's unauthorized use of Covered Information.
7.Notification of Non-Compliance
The Company must promptly notify Customer when it makes a determination that it can no longer meet its obligations under this Addendum or Applicable State Privacy Laws.
A.

Appendix A – Data Processing

Categories of data subjects whose personal data is processed

Customer employees

Customer content

Categories of personal data Processed

1. Information uploaded to the Service, including:

Uploaded PLC files - PLC programs, routines, tag databases, and configuration files (including Allen-Bradley, Siemens, and CODESYS formats)

Prompts, instructions, and other inputs to AI features

AI-generated outputs such as analyzed, modified, or newly generated PLC code, explanations, and documentation.

Customer Pictures

Other related content

2. Profile details of Customer's users, such as full name and profile picture, as displayed to other members of Customer's organization in the Service. Account, authentication and security data of users is processed by the Company as controller under its Privacy Policy.

The frequency of the Processing

Continuous during the Term, to the extent that the Service provided by the Company will involve the processing of individuals' personal data.

Nature of the processing

Collection, organization, structuring and delivery of such data on behalf of the Customer as specified under the Terms. The nature of the processing is mainly to electronically collect, process and provide Service.

Purpose(s) of the data Processing and further processing

Personal data is contained in the data which Customer provides through the Service. Company has access to such data solely for purposes pursuant to the Terms, and this Addendum.

The period for which the personal data will be retained

During the provision of the Service, until deleted from the Service or upon termination. The general guidelines are as follows:

Customer Content (PLC Files and AI Outputs) - On an explicit deletion or erasure request: deleted without undue delay, no later than thirty (30) days; not archived. On contract termination (including a lapsed subscription): held in archive for sixty (60) days, during which the customer may request export by emailing support@plcs.ai, then purged from active systems. Backups deleted in normal rotation. Archive-as-a-feature is available separately and governed by the Customer Agreement.

Profile details of Customer's users - Term of subscription + 60 days. Held in archive for retrieval; purged from active systems after 60 days. Retained longer if required by law.

For transfers to (sub-) processors - location, subject matter, nature and duration of the processing

Cloud infrastructure, backup storage, payment processing, email delivery, customer support tooling, third-party AI model providers (No training is allowed) and analytics. All subprocessors are located in the United States; EU/UK transfers rely on Standard Contractual Clauses. A current list of our Subprocessors is available upon request at privacy@plcs.ai. The Company will notify the Customer of any material changes to our Subprocessors in advance.

For questions about this Addendum, to request a signed copy, or for Subprocessor information, contact us at privacy@plcs.ai.