This Data Processing Agreement ("DPA") is incorporated into and forms part of (i) the Ultralytics Terms of Service and/or (ii) any applicable order form, enterprise agreement, or other written agreement referencing this DPA (each, the "Agreement") between the customer ("Customer", "you") and Ultralytics, Inc. ("Ultralytics", "Company", "we").
This DPA reflects the parties' agreement with respect to:
This DPA remains in effect for the term of the Agreement and for so long as Ultralytics Processes Customer Personal Data on Customer's behalf.
This DPA applies solely to the Processing of Customer Personal Data by Ultralytics within the Ultralytics Platform. For the avoidance of doubt, this DPA does not apply to Customer's use, deployment, or operation of Ultralytics YOLO open-source models outside the Ultralytics Platform, which is conducted under Customer's sole responsibility.
Ultralytics may update this DPA from time to time to reflect changes in law, regulatory guidance, or the Services, effective as of the date posted, provided that updates do not materially reduce the privacy protections for Customer Personal Data without Customer's agreement (except where required by applicable law).
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of voting interests.
"Appropriate Safeguards" means such legally enforceable mechanism(s) for transfers of Personal Data as may be permitted under the applicable Data Protection Laws, especially but not limited to Article 46 GDPR.
"Sub-Processor" means any Processor engaged by Ultralytics or its Affiliates to Process Customer Personal Data on Ultralytics' behalf in connection with the Services.
"Company Account Data" means personal data that relates to Company's relationship with Customer, including the names or contact information of individuals authorized by Customer to access Customer's account and billing information of individuals that Customer has associated with its account. Company Account Data also includes any data Company may need to collect for the purpose of managing its relationship with Customer, identity verification, or as otherwise required by applicable laws and regulations.
"Company Usage Data" means Service usage data collected and processed by Company in connection with the provision of the Services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.
"Customer Data" means any data, content, materials, files, or information (including datasets, images, video, annotations, labels, metadata, model inputs and outputs, and other content) that Customer or its authorized users upload to, submit through, transmit to, or otherwise make available for Processing in connection with the Services, including any data generated for Customer through Customer's use of the Services.
"Customer Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data Processed by Ultralytics or its Sub-Processors in connection with the Services. Customer Personal Data Breach does not include unsuccessful attempts or activities that do not compromise Customer Personal Data (e.g., unsuccessful log-in attempts, port scans, denial-of-service attacks, or other attacks on firewalls or networked systems).
"Data Protection Laws" means all applicable laws relating to privacy and data protection that apply to a party's Processing of Personal Data under the Agreement, including (as applicable) the GDPR, UK GDPR, Swiss FADP, ePrivacy/PECR, CCPA/CPRA and other applicable US state privacy laws.
"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law; "Swiss FADP" means the Swiss Federal Act on Data Protection (as revised). "Instructions" means Customer's documented instructions to Ultralytics regarding Processing of Customer Personal Data, as described in Section 2.2.
"SCCs" means the EU standard contractual clauses (Decision 2021/914); "UK Addendum" means the ICO International Data Transfer Addendum. Other capitalised terms have the meanings given in Data Protection Laws and/or the Agreement.
"Services" means the services and functionalities made available by Ultralytics to Customer under the Agreement, including the Ultralytics Platform and any related support, administration, and documentation, as further described in the Agreement.
"Ultralytics Platform" means Ultralytics' cloud-based software-as-a-service environment through which Customers may upload, manage, annotate, and version datasets; train, evaluate, compare, export, and deploy computer vision models; manage projects and users; and access related features and support, and through which Ultralytics Processes Customer Personal Data on Customer's behalf in accordance with this DPA.
"Ultralytics YOLO Open-Source Models" mean the open-source computer vision models and related source code made available by Ultralytics under applicable open-source licences, which Customers may download, deploy, host, and operate independently in their own environments. For clarity, where Customers deploy or use Ultralytics YOLO Open-Source Models outside the Ultralytics Platform, Ultralytics does not Process Personal Data on Customer's behalf under this DPA.
2.1 Compliance with Laws. Customer is responsible for complying with Data Protection Laws in connection with its Processing of Personal Data and its use of the Services, including providing required notices and obtaining any required consents and authorizations.
2.2 Instructions. The Agreement (including this DPA), together with Customer's configuration and use of the Services in accordance with the Agreement, constitute Customer's complete Instructions to Ultralytics for Processing Customer Personal Data. Customer may provide additional Instructions during the term, provided they are consistent with the Agreement and the Services. If Ultralytics reasonably believes additional Instructions require material changes or burden, the parties will discuss in good faith.
2.3 Prohibited Data. Unless expressly agreed in writing by the parties (including agreement on additional safeguards required by applicable Data Protection Laws), Customer shall not provide to, submit through, or otherwise make available to Ultralytics any Special Categories of Personal Data under Article 9 GDPR (or equivalent), or data relating to criminal convictions or offences under Article 10 GDPR.
By way of illustration and without limitation, Prohibited Data includes:
Additionally, the Services are also not intended to process other data requiring heightened protection under applicable Data Protection Laws, such as payment card data, bank account numbers, or precise geolocation. Customer is solely responsible for ensuring that datasets, images, video, annotations, labels, metadata, or other content uploaded to or processed through the Services do not include Prohibited Data. Any Processing of Prohibited Data in breach of this Section constitutes a material breach of this DPA.
2.4 Inappropriate Data; Indemnity. Customer is solely responsible for the legality of Customer Personal Data provided to Ultralytics and for ensuring it is appropriate for the Services. Customer will defend and indemnify Ultralytics from and against any third-party claims arising from Customer's provision of Personal Data to the Services in breach of the Agreement, this DPA, or applicable Data Protection Laws.
3.1 Purpose Limitation. Ultralytics will Process Customer Personal Data only (a) to provide the Services in accordance with the Agreement and Exhibit A, (b) in accordance with Customer's Instructions, and (c) as required by applicable law. Ultralytics will not use Customer Personal Data or Customer Data to train, improve, or develop Ultralytics' general or commercially available models, except where expressly instructed by Customer in writing or through the Services.
3.2 Conflict of Laws. If Ultralytics becomes aware it cannot Process Customer Personal Data in accordance with Instructions due to a legal requirement, Ultralytics will (to the extent permitted by law) notify Customer and, where necessary, suspend the affected Processing (other than secure storage) until Customer issues compliant Instructions.
3.3 Personnel Confidentiality. Ultralytics will ensure persons authorized to process Customer Personal Data are bound by confidentiality obligations. Customer agrees Ultralytics may disclose Customer Personal Data to its professional advisers and auditors as reasonably required in connection with performance of the Agreement/DPA, subject to confidentiality obligations.
3.4 Sub-processing. Ultralytics may engage Sub-Processors in accordance with Section 5 and remains responsible for their performance of equivalent obligations.
3.5 Deletion / Return. Upon termination of the Services, Ultralytics will delete or return Customer Personal Data in accordance with the Agreement and Exhibit A, unless retention is required by law. Deletion certification under SCCs will be provided upon Customer's request.
4.1 Data Subject (or Consumer) Request. Ultralytics shall, to the extent legally permitted, notify Customer at the primary contact in the account without undue delay if Ultralytics receives a request from a Data Subject (or Consumer) to exercise the Data Subject's (or Consumer's) right of access (or disclosure), right to rectification, restriction of Processing, erasure (or deletion or the "right to be forgotten"), data portability, object to the Processing, or its right not to be subject to an automated individual decision making ("Data Subject (or Consumer) Request").
4.2 Assistance. Taking into account the nature of Processing, Ultralytics will provide reasonable assistance to Customer to respond to requests to exercise Data Subject rights under Data Protection Laws, to the extent Customer cannot fulfil the request using available Service functionality.
4.3 DPIA; Prior Consultation. Taking into account the nature of Processing and the information available to Ultralytics, Ultralytics will provide reasonable assistance to Customer with (i) data protection impact assessments and (ii) Customer's consultation and/or cooperation with supervisory authorities, in each case where required by Data Protection Laws and where Customer does not otherwise have access to relevant information. Except where required by Data Protection Laws or in connection with a Customer Personal Data Breach, Customer shall not request such assistance more than once in any twelve (12) month period. Customer will reimburse Ultralytics' reasonable costs and expenses incurred in providing such assistance, where permitted by law.
5.1 General Authorization. Customer grants Ultralytics a general written authorization to engage Sub-Processors to Process Customer Personal Data for the Services.
5.2 List and Notice. A list of current Sub-Processors is available at https://trust.ultralytics.com/subprocessors (the "List"). Ultralytics will provide a mechanism to subscribe to notifications of updates to the List and will provide notice of new Sub-Processors at least ten (10) days before authorizing them to Process Customer Personal Data. Customer is responsible for subscribing to such notifications where available; if Customer does not subscribe, Customer acknowledges it may not receive prior notice via that mechanism. In all cases, updates to the List shall constitute notice of changes to Sub-Processors. Customer acknowledges that certain Sub-Processors are essential to providing the Services and that objecting to the use of a sub-processor may prevent Company from offering the Services to Customer.
For clarity, Ultralytics Affiliates involved in the provision of the Services, including Ultralytics Ltd (UK) and Ultralytics AI Spain, S.L., may act as intra-group Sub-Processors where they Process Customer Personal Data on behalf of Ultralytics Inc. in connection with the Services.
5.3 Objection to New Sub-Processors. Customer may object in writing to the engagement of a new Sub-processor on reasonable data protection grounds according to Section 5.2. If Ultralytics cannot reasonably address Customer's objection, Customer may discontinue the affected Service by written notice, without relieving Customer of any fees accrued prior to such discontinuation.
5.4 Flow-down. Ultralytics will engage Sub-Processors only after conducting reasonable, risk-based due diligence to assess whether the Sub-processor is capable of providing an appropriate level of protection for Customer Personal Data in accordance with applicable Data Protection Laws, and will periodically monitor Sub-Processors as part of its vendor management program. Ultralytics will ensure that its Sub-Processors are subject to data protection obligations that are materially equivalent to, or more protective than, those set out in this DPA. Upon Customer's request, Ultralytics will provide copies (which may be redacted for confidentiality) of relevant Sub-processor data protection terms as required under the SCCs.
6.1 Measures. Taking into account the state of the art, the nature, scope, context and purposes of the Processing, and the risk of varying likelihood and severity for the rights and freedoms of natural persons, Ultralytics shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to such risk, in accordance with applicable Data Protection Laws, including Article 32 of the GDPR. These measures are described in Exhibit C, which Ultralytics may update from time to time, provided that any such update does not materially reduce the overall level of protection for Customer Personal Data.
6.2 Customer Responsibilities. Notwithstanding the foregoing, Customer acknowledges that, except as expressly provided in this DPA, Customer is responsible for its secure use of the Services, including safeguarding its account authentication credentials, configuring access controls appropriately, and ensuring that its users access and use the Services in a manner consistent with applicable Data Protection Laws and the security features made available by Ultralytics.
7.1 Documentation. Upon reasonable request, Ultralytics will make available information reasonably necessary to demonstrate compliance with this DPA (including current third-party audit reports or certifications, where available). Ultralytics will maintain records sufficient to demonstrate compliance with this DPA and retain such records for a reasonable period following termination (e.g., three (3) years), unless a longer period is required by law.
7.2 Audit. Where Data Protection Laws require and documentation is insufficient, Customer may, upon reasonable prior written notice and at Customer's expense, request an audit or inspection of Ultralytics' relevant systems and processes. Any such audit or inspection shall be conducted only following mutual written agreement between the parties on the scope, timing, and duration of the audit, as well as any reasonable reimbursement rate for Ultralytics' time and resources expended in connection with the audit. Any audit conducted pursuant to this Section shall:
Customer shall promptly notify Ultralytics of any material non-compliance identified during an audit to allow Ultralytics a reasonable opportunity to address such findings.
8.1 Notice. Ultralytics will notify Customer without undue delay but no later than 72 hours after becoming aware of a Customer Personal Data Breach.
8.2 Assistance. Ultralytics will provide reasonable assistance for Customer's required notifications to regulators and affected Data Subjects, taking into account the information available to Ultralytics.
8.3 No Admission. Breach notification does not constitute an admission of fault or liability. The breach-notification obligation does not apply to the extent a Customer Personal Data Breach is caused by Customer's or its users' actions or omissions.
9.1 International Transfers. Customer acknowledges that Ultralytics' primary processing operations may occur in the United States and other locations as necessary to provide the Services.
For clarity, Customer Personal Data may also be transferred between Ultralytics Inc. and its Affiliates (including Ultralytics Ltd (UK) and Ultralytics AI Spain, S.L.) where such Affiliates act as Sub-Processors in connection with the Services. Where such transfers qualify as international transfers under applicable Data Protection Laws, they shall be subject to Appropriate Safeguards, including the SCCs (Module 3, where applicable) or other valid transfer mechanisms.
Where the transfer of Customer Personal Data to a country that has not been recognized as providing an adequate level of data protection is required, such transfers will be made subject to Appropriate Safeguards in accordance with applicable Data Protection Laws, including, where applicable, the SCCs and the UK Addendum as incorporated into this DPA.
9.2 EU SCCs. For transfers of Customer Personal Data subject to GDPR to a third country without adequacy, the parties incorporate the EU SCCs. Module Two (Controller→Processor) applies where Customer is a Controller; Module Three (Processor→Sub-Processor) applies where Customer is a Processor. The SCC annexes are completed using Exhibit B (Annex I/III) and Exhibit C (Annex II).
9.3 UK Addendum. For transfers subject to UK GDPR, the parties incorporate the UK Addendum, completed by reference to Exhibit B/C and the applicable transfer mechanism selection.
9.4 Switzerland. For Swiss transfers, the EU SCCs apply with the standard Swiss modifications (references to GDPR include Swiss FADP; FDPIC as competent authority, etc.), completed by reference to Exhibits.
9.5 Government Access Requests. Ultralytics will handle legally binding requests for Customer Personal Data consistent with applicable law and the SCCs, including (where legally permitted) notice to Customer and reasonable cooperation.
10.1 Scope. This Section applies to Processing of Controller Personal Data by each party as an independent Controller (not joint controllers), including Ultralytics' Processing of Company Account Data and Company Usage Data.
10.2 Independent Controller Obligations. Each party will:
10.3 Ultralytics Controller Processing. Ultralytics Processes Company Account Data and Company Usage Data as a Controller for: account administration, billing, security monitoring and abuse prevention, identity verification, legal compliance, audits/accounting, and service operations (including performance and reliability). Such Processing is described in the Ultralytics Privacy Policy. Nothing in this DPA shall be construed as creating a joint controller relationship between the parties.
For the avoidance of doubt, Ultralytics and its Affiliates may process limited business contact data (such as names, corporate email addresses, and professional contact details) in the context of commercial outreach, demonstrations, partnerships, and customer relationship management activities as independent Controllers.
11.1 Service Provider / Processor. To the extent CCPA/CPRA applies and Ultralytics Processes Customer Personal Data on Customer's behalf, Ultralytics acts as a "service provider" and/or "processor", and will not "sell" or "share" such personal information.
11.2 Limited Use. Ultralytics will not retain, use, or disclose Customer Personal Data outside the direct business purpose of providing the Services except as permitted by CCPA/CPRA.
11.3 Discrimination. The Parties must not discriminate against a Consumer because they exercised their rights.
12.1 Limitation of Liability. The limitations and exclusions in the Agreement apply to this DPA, except as prohibited by law or the SCCs/UK Addendum.
12.2 Severability. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties' intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
12.3 Execution of this DPA. This DPA is incorporated into and forms part of the Agreement. Customer enters into this DPA (including, where applicable, the EU SCCs and the UK Addendum) by:
Customer represents and warrants that the individual accepting the Agreement and/or using the Services on Customer's behalf has authority to bind Customer and, where applicable, its Affiliates.
12.4 Contact. Privacy requests: privacy@ultralytics.com; DPO: dpo@ultralytics.com; legal notices: legal@ultralytics.com.
Customer enters into this DPA on behalf of itself and its Affiliates that are authorized users of the Services under the Agreement and are Controllers/Processors of Customer Personal Data ("Permitted Affiliates"). Customer represents it has authority to bind Permitted Affiliates.
Nature: Ultralytics provides a cloud-based software and related services that enable Customers to access and use Ultralytics products and features, including model training, inference, dataset management, deployment workflows, and related support and administration ("Services"), as described in the Agreement.
For clarity, the Services include the Ultralytics Platform, through which Ultralytics Processes Customer Personal Data on Customer's behalf in accordance with this DPA. Separately, Ultralytics also makes available Ultralytics YOLO open-source models, which Customers may deploy and operate independently in their own environments. Where Customers deploy or use Ultralytics YOLO models outside the Ultralytics Platform, Ultralytics does not Process Personal Data on Customer's behalf, and Customers are solely responsible for implementing appropriate technical and organizational measures, determining purposes and means of Processing, and ensuring compliance with applicable Data Protection Laws in connection with such deployment and use.
Purpose: Ultralytics Processes Customer Personal Data on behalf of Customer for the following purposes:
Ultralytics will not use Customer Personal Data to train or improve Ultralytics' general models except as expressly instructed by Customer in writing or via the Services. For clarity, Ultralytics may use Company Usage Data and aggregated or de-identified data (where permitted) to operate, secure, and improve the Services.
Where Customer elects to share datasets, models, or other content via community or public features of the Services, such sharing constitutes Customer's documented instruction. Customer remains solely responsible for ensuring it has all necessary rights and lawful bases to make such data available to other users.
Duration of Processing: Ultralytics will Process Customer Personal Data for the duration of the Agreement and for as long as necessary to provide the Services in accordance with Customer's Instructions. Following termination or expiration of the Agreement, Ultralytics will delete or return Customer Personal Data in accordance with the Agreement and this DPA, unless further retention is required by applicable law. For clarity, where Ultralytics Processes Controller Personal Data (including Company Account Data and Company Usage Data) as an independent Controller under Section 10, such Processing will occur for the periods set forth in the Ultralytics Privacy Policy.
Categories of Data Subjects: Customer Personal Data may relate to the following categories of Data Subjects, as determined and controlled by Customer:
Categories of Personal Data: Customer Personal Data may include the following categories of Personal Data, to the extent submitted to or otherwise made available through the Services by or on behalf of Customer:
The categories of Personal Data processed may further include those described in the Ultralytics Privacy Policy.
Sensitive Data or Special Categories of Data: The Services are not designed or intended to Process Special Categories of Personal Data (as defined in Article 9 GDPR or equivalent under applicable Data Protection Laws) or Personal Data relating to criminal convictions and offences (Article 10 GDPR), and Customer is prohibited from providing such data unless expressly agreed in writing with Ultralytics and subject to additional safeguards.
The following includes the information required by Annex I and Annex III of the EU SCCs, and Table 1, Annex 1A, and Annex 1B of the UK Addendum.
1. The Parties
Data exporter(s):
Data importer(s):
2. Description of the Transfer
3. Competent Supervisory Authority
The supervisory authority shall be the supervisory authority of the Data Exporter, as determined in accordance with Clause 13 of the EU SCCs. The supervisory authority for the purposes of the UK Addendum shall be the UK Information Commissioner's Office.
The following includes the information required by Annex II of the EU SCCs and Annex II of the UK Addendum.
International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
Table 1: Parties
Table 2: Selected SCCs, Modules and Selected Clauses
Table 3: Appendix Information
"Appendix Information" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this UK Addendum is set out in:
Table 4: Ending this UK Addendum when the Approved UK Addendum Changes
Note: This provision permits the selected party (if any) to terminate the UK Addendum if the ICO changes the approved UK Addendum which directly results in a substantial, disproportionate, and demonstrable increase in (a) its direct costs of performing its obligations under the UK Addendum or (b) its risk under the UK Addendum.
Each party agrees to be bound by the terms and conditions set out in this UK Addendum, in exchange for the other party also agreeing to be bound by this UK Addendum.
Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making ex-UK Transfers, the Parties may enter into this UK Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this UK Addendum. Entering into this UK Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Where this UK Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:
The UK Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfills the Parties' obligation to provide the Appropriate Safeguards.
If the provisions included in the UK Addendum amend the Approved EU SCCs in any way which is not permitted under the Approved EU SCCs or the Approved UK Addendum, such amendment(s) will not be incorporated in the UK Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and the UK Addendum, UK Data Protection Laws will apply.
If the meaning of the UK Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after the UK Addendum has been entered into.
Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for ex-UK Transfers, the hierarchy in Section 10 below will prevail.
Where there is any inconsistency or conflict between the Approved UK Addendum and the EU SCCs (as applicable), the Approved UK Addendum overrides the EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved UK Addendum.
Where this UK Addendum incorporates EU SCCs which have been entered into to protect ex-EU Transfers subject to the GDPR, then the parties acknowledge that nothing in the UK Addendum impacts those EU SCCs.
This UK Addendum incorporates the EU SCCs which are amended to the extent necessary so that:
Unless the parties have agreed alternative amendments which meet the requirements of Section 12 of this UK Addendum, the provisions of Section 15 of this UK Addendum will apply.
No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 of this UK Addendum may be made.
The following amendments to the EU SCCs (for the purpose of Section 12 of this UK Addendum) are made:
The parties may agree to change Clauses 17 and/or 18 of the EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
If the parties wish to change the format of the information included in Part 1: Tables of the Approved UK Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
From time to time, the ICO may issue a revised Approved UK Addendum which:
The revised Approved UK Addendum will specify the start date from which the changes to the Approved UK Addendum are effective and whether the parties need to review this UK Addendum including the Appendix Information. This UK Addendum is automatically amended as set out in the revised Approved UK Addendum from the start date specified.
If the ICO issues a revised Approved UK Addendum under Section 18 of this UK Addendum, if a party will as a direct result of the changes in the Approved UK Addendum have a substantial, disproportionate and demonstrable increase in:
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that party may end this UK Addendum at the end of a reasonable notice period, by providing written notice for that period to the other party before the start date of the revised Approved UK Addendum.
The parties do not need the consent of any third party to make changes to this UK Addendum, but any changes must be made in accordance with its terms.
