Data Processing Addendum (DPA)

v1.0. Last updated: 23 June 2025

This Data Processing Addendum ("DPA") is entered into between Dreem.ai ApS ("Dreem") and the Customer, and forms part of the Dreem Terms of Service ("Agreement").

This DPA applies to the extent Dreem processes Personal Data on behalf of Customer in providing the Services.

1. Definitions

Capitalised terms not defined in this DPA have the meaning set out in the Agreement.

• "Controller", "Processor", "Data Subject", "Personal Data", and "Processing" have the meanings given in the GDPR.
• "Customer Data" means Personal Data that Customer uploads or provides via the Services.
• "Sub-processor" means any third party engaged by Dreem to Process Customer Data.

2. Roles and Scope

Customer is the Controller and Dreem is the Processor of Customer Data. This DPA applies only to Customer Data subject to EU/EEA or UK data protection laws.

3. Processing Instructions

Dreem shall process Customer Data only on documented instructions from the Customer. This includes instructions regarding the subject matter, nature, purpose, and duration of the processing, the types of Personal Data, and the categories of Data Subjects.

The processing is carried out on the legal basis defined by the Customer in accordance with Articles 6 and/or 9 of the GDPR, as applicable. Dreem processes Personal Data solely based on documented instructions provided by the Customer.

Dreem shall not process Customer Data for any other purpose unless required to do so by Union or Member State law to which Dreem is subject. In such cases, Dreem shall inform the Customer of the legal requirement before processing, unless prohibited from doing so on important grounds of public interest.

If Dreem considers that an instruction from the Customer infringes the GDPR or other applicable data protection law, Dreem shall promptly inform the Customer and suspend further processing until the instruction is confirmed, amended, or withdrawn.

4. Confidentiality

Dreem ensures that all personnel authorised to process Customer Data are bound by confidentiality obligations.

5. Sub-processors

Dreem uses Sub-processors listed at https://dreem.ai/legal/subprocessors. Dreem will:

• Provide at least 30 days’ notice before adding or replacing a Sub-processor;
• Ensure Sub-processors are bound by equivalent data protection terms.

Customer may object to a new Sub-processor for reasonable grounds related to data protection.

6. Security Measures

Dreem implements appropriate technical and organisational measures, including:

• Encryption at rest and in transit;
• Logical access controls;
• Data segregation;
• Regular vulnerability testing;
• SOC 2 Type II compliance;
• Incident response procedures.

In the event of a Personal Data Breach, Dreem will notify Customer without undue delay and in any case within 72 hours of becoming aware.

7. Data Transfers

For transfers from the UK, the UK International Data Transfer Addendum (version B.1.0) is incorporated. For Switzerland, references to ‘Member State’ and ‘GDPR’ in the SCCs shall be interpreted under the Swiss FADP.

Customer Data may be transferred outside the EEA. Dreem relies on:

• Hosting in the EU (Frankfurt AWS region);
• Standard Contractual Clauses (SCCs);
• Supplementary safeguards.

8. Assistance & Data Subject Rights

Dreem will assist Customer in:

• Responding to Data Subject requests;
• Conducting DPIAs and prior consultations.

Requests must be submitted to legal@dreem.ai.

Dreem shall cooperate, upon request, with the relevant supervisory authority in the performance of its tasks, to the extent required by applicable law

9. Return or Deletion

Upon account deletion, Dreem will delete Customer Data within 30 days, unless retention is required by law. Downgrades to a Free plan do not trigger deletion.

Encrypted backups are overwritten on a 35-day rolling cycle.

The processing of Customer Data will continue for the duration of the Agreement and until data deletion has been completed in accordance with Section 9 of this DPA.

Upon termination of the Services, Dreem shall, at the choice of the Customer, delete or return all Customer Data and delete existing copies unless Union or Member State law requires storage of the personal data.

10. Audit Rights

Customer is entitled to carry out audits and inspections, including on-site audits, at its own cost, once per year or more frequently if required by law or a supervisory authority. Such audits must be subject to reasonable scheduling and confidentiality obligations.

On request, Dreem will provide documentation of its compliance (e.g. SOC 2 report). Customers may audit Dreem once per year with 30 days' notice, subject to confidentiality.

11. Liability

Each party’s liability under this DPA is subject to the limitations set out in the Agreement, except for breaches of this DPA caused by Dreem’s gross negligence or wilful misconduct.

12. Precedence

If this DPA conflicts with the Agreement, this DPA prevails for data protection matters. The SCCs prevail over this DPA and the Agreement in case of conflict.

13. Legal Entity & Contact

Dreem.ai ApS
Nupark 43
7500 Holstebro
Denmark
legal@dreem.ai

14. Annexes

See:

• Annex I – Description of Processing
• Annex II – Technical & Organisational Measures
• Annex III – Authorised Sub-processors

15. Version History

To request a signed DPA, please contact your Dreem account representative.