Data Processing Addendum

Effective date: October 20, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Teable AI, Inc. ("Teable," "we," "us") and the customer that uses Teable's hosted service ("Customer," "you") under Teable's Terms of Service or another written agreement for the service (the "Agreement"). It applies whenever Teable processes Customer Personal Data on Customer's behalf in providing the Teable hosted service, including app.teable.ai and its AI features (the "Service"). It takes effect when Customer accepts the Agreement, or on the effective date above if Customer accepted the Agreement earlier. If you need a countersigned copy, contact us at support@teable.ai.

1. Definitions

• "Data Protection Laws" means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA").
• "Customer Personal Data" means personal data that Customer or its users submit to the Service, or that Teable otherwise processes on Customer's behalf in providing the Service.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Teable or its sub-processors.
• "Sub-processor" means any third party that Teable engages to process Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0, as amended from time to time.
• "Controller," "processor," "data subject," "personal data," and "processing" have the meanings given in the GDPR. "Business," "service provider," "contractor," "sell," and "share" have the meanings given in the CCPA.

2. Roles and scope

Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own controllers. Teable is Customer's processor, or sub-processor where Customer is itself a processor.

This DPA does not cover personal data that Teable processes as a controller, such as account registration, billing, support correspondence, security logs, and website analytics. Our Privacy Policy describes that processing. For self-hosted deployments, Customer runs the software on its own infrastructure and Teable does not process the content stored there. The license compliance attestations described in the Privacy Policy are not Customer Personal Data.

Under the CCPA, Teable acts as Customer's service provider or contractor. Teable will not sell or share Customer Personal Data; will not retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service; and will not combine it with personal data Teable receives from other sources, except as the CCPA permits.

3. Details of the processing

• Subject matter. Providing the Service to Customer under the Agreement.
• Duration. The term of the Agreement, plus the period until deletion under section 10.
• Nature and purpose. Hosting, storing, organizing, retrieving, computing on, transmitting, displaying, backing up, and deleting Customer Personal Data in order to provide the Service; running the AI features, automations, apps, and integrations Customer chooses to use; providing support at Customer's request; and keeping the Service secure.
• Categories of data subjects. Customer's users and collaborators, and any individuals whose personal data Customer stores in the Service, such as Customer's employees, customers, contacts, and end users of apps Customer builds.
• Categories of personal data. Determined by Customer. Typically names, contact details, business records, files and images, comments and change history, messages and other content submitted to AI features, and connected account identifiers.
• Special categories of data. The Service is not designed for special categories of personal data. Customer decides whether to submit them, and is responsible for applying any safeguards Data Protection Laws require. The security measures in section 6 apply to all Customer Personal Data.
• Frequency. Continuous, for as long as Customer uses the Service.

4. Customer instructions

Teable processes Customer Personal Data only on Customer's documented instructions. Customer's instructions are the Agreement, this DPA, and Customer's configuration and use of the Service, including the features, permissions, integrations, and settings Customer chooses. Additional instructions require written agreement between the parties.

Teable will inform Customer promptly if, in its opinion, an instruction infringes Data Protection Laws. If a law to which Teable is subject requires other processing, Teable will inform Customer of that legal requirement before processing, unless the law prohibits it.

Customer is responsible for the lawfulness of its instructions and of the personal data it submits, including having a valid legal basis and providing any required notices to data subjects.

5. Confidentiality of personnel

Teable limits access to Customer Personal Data to personnel who need it to provide, support, or secure the Service. Everyone authorized to process Customer Personal Data is bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and receives security and privacy training.

6. Security measures

Teable implements and maintains appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. These include:

• Encryption of Customer Personal Data in transit over public networks (TLS) and at rest.
• Access control: individual accounts, multi-factor authentication for access to production systems, role-based access granted on a least-privilege basis, and periodic access reviews.
• Audit logging of access to production systems and data.
• Backups of production databases, with restore procedures.
• Vulnerability management: dependency and code scanning, timely patching, and remediation of identified vulnerabilities based on severity.

Teable may update its security measures over time, provided the updates do not materially reduce the overall protection of Customer Personal Data. More detail is available in our Trust Center at trust.teable.ai.

7. Sub-processors

Customer gives Teable general authorization to engage sub-processors. The current list of sub-processors, with the service each one provides and where it processes data, is published in our Trust Center at trust.teable.ai.

Teable will notify Customer at least 30 days before a new or replacement sub-processor begins processing Customer Personal Data, by email to the address associated with Customer's account or through the Service, and will update the list. Customer may object on reasonable data protection grounds by writing to support@teable.ai within that 30-day period. The parties will then discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service by written notice, and Teable will refund any prepaid fees for the terminated part covering the period after termination.

Teable imposes data protection obligations on each sub-processor by written contract that are no less protective than those in this DPA, to the extent applicable to the services the sub-processor provides. Teable remains responsible to Customer for its sub-processors' performance of those obligations.

8. Assistance with data subject requests

The Service lets Customer access, correct, export, and delete Customer Personal Data itself. If Teable receives a request from a data subject concerning Customer Personal Data, Teable will not respond to it, other than to direct the data subject to Customer, unless Customer authorizes it, and will promptly forward the request to Customer where it can identify Customer.

Taking into account the nature of the processing, Teable will provide reasonable assistance to help Customer respond to data subject requests where Customer cannot do so using the Service. Teable will also provide reasonable information and assistance for Customer's data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to Teable's processing.

9. Personal Data Breach notification

Teable will notify Customer of a Personal Data Breach without undue delay, and in any case within 48 hours after Teable confirms it. Teable will send the notice to the email address associated with Customer's account, and to any security contact Customer has provided.

The notice will describe, to the extent known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures Teable has taken or proposes to take to address the breach and mitigate its effects. Where Teable cannot provide all of this information at once, it will provide it in phases without further undue delay. Teable will take reasonable steps to contain and remedy the breach, and will cooperate with Customer so that Customer can meet its own obligations, including notifying supervisory authorities and data subjects. Teable's notification of a breach is not an acknowledgement of fault or liability.

10. Deletion or return at the end of the Service

During the term, Customer can export its data using the export features of the Service, and can delete its spaces, projects, tables, records, and account.

When the Agreement ends, Customer may export Customer Personal Data before its account or workspaces are closed. Teable will then delete Customer Personal Data within 30 days, unless Data Protection Laws or other applicable law require Teable to keep it. Residual copies in backups expire within a further 30 days. Teable will keep any Customer Personal Data it must retain by law confidential, and will process it only for the purpose the law requires. On request, Teable will confirm deletion in writing.

11. Audits

On Customer's written request, Teable will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes Teable's most recent third-party audit reports and certifications, where available, and its security documentation and answers to reasonable security questionnaires. Teable may require Customer to agree to reasonable confidentiality terms before sharing non-public documents.

If that information is not enough to demonstrate compliance as required by Data Protection Laws, or a supervisory authority requires it, Customer may conduct an audit, itself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, no more than once in any 12-month period (unless after a Personal Data Breach or at a supervisory authority's request), during normal business hours, and in a way that does not unreasonably disrupt Teable's operations or compromise the security of other customers' data. Customer bears its own costs of any audit.

12. International transfers

Teable is based in the United States, and processes Customer Personal Data in the United States and in the other countries where its sub-processors operate, as listed in the Trust Center.

EU transfers. To the extent Customer Personal Data originating in the European Economic Area is transferred to Teable in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. Customer is the data exporter and Teable is the data importer. Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorization) applies, with the notice period set out in section 7. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is determined as that clause provides. Under Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland. Annex I is completed with the parties' details below and the details in section 3; Annex II with the measures in section 6; and Annex III with the sub-processor list in the Trust Center.

UK transfers. To the extent Customer Personal Data originating in the United Kingdom is transferred, the UK Addendum is incorporated into this DPA by reference and amends the SCCs as set out above. Tables 1 to 3 of the UK Addendum are completed with the information in this DPA, and either party may end the UK Addendum as described in its Section 19.

Swiss transfers. To the extent Customer Personal Data originating in Switzerland is transferred, the SCCs apply with these amendments: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; references to the GDPR include the FADP; and the term "Member State" includes Switzerland, so that data subjects in Switzerland can enforce their rights there.

Parties for Annex I. Data exporter: Customer, as identified in the Agreement or Customer's account, with the contact details provided there. Data importer: Teable AI, Inc., 1111B S Governors Ave, STE 48501, Dover, DE 19904, United States; contact support@teable.ai; role: processor. Customer's acceptance of the Agreement is treated as both parties' signature of the SCCs and the UK Addendum.

13. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not permit such a limitation.

14. General

Order of precedence. If there is a conflict, the SCCs and UK Addendum (where they apply) prevail over this DPA, and this DPA prevails over the Agreement with respect to the processing of Customer Personal Data.

Changes. Teable may update this DPA to reflect changes in Data Protection Laws or in the Service. Updates will not materially reduce the protection of Customer Personal Data, and Teable will give at least 30 days' notice of material updates.

Governing law. This DPA is governed by the law that governs the Agreement, and disputes under it are resolved as the Agreement provides, except that the SCCs are governed as set out in section 12.

Contact. For questions about this DPA, contact Teable AI, Inc. at support@teable.ai.