Specification of Data Processing

A1.1 Subject matter of the processing. Uncle Louis processes Personal Data on behalf of the Subscriber in order to provide the Uncle Louis AI platform, an AI-assisted research, drafting, and workflow workspace for international tax professionals.

A1.2 Duration of the processing. For the duration of the Agreement (Initial Service Term and any Renewal Terms), and thereafter only for the period strictly necessary to return or securely delete Personal Data in accordance with Section 11 of this DPA, or for the period of any mandatory retention required by applicable law.

A1.3 Nature and purpose of the processing. (a) Hosting and serving the web application and APIs that compose the Services; (b) authentication of users and management of user sessions; (c) storage and retrieval of Subscriber Content (including chat threads, memoranda, uploaded documents, and metadata); (d) AI inference for the generation of tax research, analysis, drafting assistance, and citation support; (e) observability and quality monitoring of AI outputs to detect regressions and prevent hallucinations; (f) transactional notifications to Subscriber's administrators and end users (e.g. account activation, password reset, invitation, billing); (g) customer support and incident response; (h) functional and (where consented) behavioural analytics, in accordance with Section 14.3.

A1.4 Categories of data subjects. (a) Subscriber's administrators and end users; (b) Subscriber's clients and other natural persons identified in Subscriber Content (e.g. parties to a tax structure, recipients of a memorandum); (c) third parties whose Personal Data may incidentally appear in documents uploaded to the Services.

A1.5 Categories of Personal Data. (a) Account data: email address, display name, organisation name, job title, locale preference; (b) Authentication data: hashed credentials, session identifiers, multi-factor tokens; (c) Subscriber Content: chat prompts, generated Output, uploaded documents, memoranda, and any Personal Data contained therein; (d) Technical data: IP address, user agent, request timestamps, audit log entries; (e) Billing contact data: billing name, billing email, billing address, VAT number, invoice history; (f) Support data: ticket content and attachments.

A1.6 Special categories of Personal Data. The Services are not intended for the processing of special categories of Personal Data within the meaning of Article 9 GDPR. The Subscriber is responsible for ensuring that any such data is not submitted to the Services without a valid legal basis and appropriate safeguards.