Data Processing Addendum (DPA)

1. Definitions and Interpretation

In this Addendum, the following terms have the meanings set out below. Capitalized terms not defined herein have the meanings given in the GDPR or the Agreement.

"Agreement"

The Terms of Service or any signed enterprise agreement between the parties.

"Controller"

The customer or entity determining the purposes and means of processing.

"Processor"

DevStackIO, acting as data processor on behalf of the Controller.

"GDPR"

Regulation (EU) 2016/679 of the European Parliament and of the Council.

"Personal Data"

Any information relating to an identified or identifiable natural person.

"Processing"

Any operation performed on Personal Data as defined in Article 4(2) GDPR.

"Subprocessor"

Any third party engaged by Processor to process Personal Data on behalf of Controller.

"Supervisory Authority"

The data protection authority competent under GDPR.

2. Scope and Applicability

This Addendum applies to all Processing of Personal Data by Processor on behalf of Controller in connection with the Services provided under the Agreement. It is designed to comply with Article 28(3) GDPR and forms a legally binding contract between the parties.

In the event of a conflict between this Addendum and the Agreement, this Addendum prevails with respect to data protection matters. This Addendum does not apply to Processing where Controller acts as a processor for a third party.

3. Processing Details

The subject matter, nature, purpose, duration, categories of Personal Data, and categories of Data Subjects are set out in Annex 1.

Processor shall only Process Personal Data in accordance with Controller's documented instructions, unless required by applicable law to which Processor is subject. In such case, Processor shall inform Controller of that legal requirement before Processing, unless prohibited by law on important grounds of public interest.

4. Controller Obligations

Controller represents and warrants that:

• It has obtained all necessary consents and legal bases for Processing;
• Its instructions to Processor comply with applicable data protection laws;
• It will not provide Personal Data that it is not authorized to share;
• It will respond promptly to Data Subject requests and cooperate with Processor.

5. Processor Obligations

Processor shall:

• Process Personal Data only on Controller's documented instructions;
• Ensure all personnel authorized to Process Personal Data are subject to confidentiality obligations;
• Implement and maintain the technical and organizational measures set out in Annex 2;
• Not engage Subprocessors without prior specific or general written authorization (see Section 7);
• Assist Controller in fulfilling its obligations under Articles 32-36 GDPR;
• Notify Controller promptly if it becomes aware of any instruction that violates GDPR or other data protection laws;
• Ensure that Subprocessors are bound by written agreements with substantially the same data protection obligations;
• Delete or return all Personal Data at Controller's choice upon termination (see Section 11).

6. Technical and Organizational Measures

Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex 2. These measures shall ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services.

Processor shall regularly test, assess, and evaluate the effectiveness of these measures. Processor shall promptly inform Controller of any material changes to its security measures that may affect the Processing.

7. Subprocessors

Controller provides general written authorization for Processor to engage the Subprocessors listed inAnnex 3.

Processor shall notify Controller of any intended changes concerning the addition or replacement of Subprocessors at least 30 days in advance, providing Controller with the opportunity to object in writing within 14 days. Objections must be based on reasonable grounds relating to data protection. If Controller objects, Processor shall either not engage the Subprocessor or, if technically feasible, provide an alternative solution.

Processor shall ensure that all Subprocessors are bound by written agreements imposing obligations no less protective than those in this Addendum. Processor remains fully liable for the acts and omissions of its Subprocessors.

8. Data Subject Rights

Taking into account the nature of Processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests for exercising Data Subject rights under Articles 15-22 GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated decision-making and profiling (Article 22)

Processor shall notify Controller without undue delay upon receiving any direct request from a Data Subject and shall not respond to such request without Controller's prior written authorization, unless legally compelled to do so.

9. International Transfers

Processor shall not transfer Personal Data outside the European Economic Area (EEA), the UK, or Switzerland unless adequate safeguards are in place pursuant to Chapter V GDPR. Any such transfers shall be governed by:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions; or
• Binding Corporate Rules (BCRs) or other approved mechanisms.

Processor shall inform Controller of the legal basis for any international transfer and provide a copy of the applicable safeguards upon request. Current Subprocessors and their transfer mechanisms are listed inAnnex 3.

10. Personal Data Breach Notification

Processor shall notify Controller without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach. The notification shall include:

• Nature of the breach, including categories and approximate number of Data Subjects and records affected;
• Name and contact details of the Data Protection Officer or other contact point;
• Likely consequences of the breach;
• Measures taken or proposed to address the breach, including measures to mitigate possible adverse effects.

Processor shall cooperate with Controller in investigating, mitigating, and remediating the breach, and shall provide reasonable assistance in Controller's notification to Supervisory Authorities and Data Subjects as required under Articles 33-34 GDPR.

11. Deletion or Return of Personal Data

Upon termination of the Agreement or at Controller's written request, Processor shall, at Controller's choice:

• Delete all Personal Data; or
• Return all Personal Data to Controller in a commonly used, machine-readable format.

Processor shall delete existing copies unless storage is required by applicable law. Processor shall certify in writing that it has complied with this obligation within 30 days of termination or request. This obligation applies to all Subprocessors as well.

12. Audit and Inspection

Processor shall make available to Controller all information necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, conducted by Controller or its mandated auditor.

Audits shall be conducted during normal business hours, with reasonable notice (minimum 14 days), and in a manner that minimizes disruption to Processor's operations. Controller shall bear the costs of audits unless a material non-compliance is discovered, in which case Processor bears the costs.

Processor may provide a SOC 2 Type II report or equivalent certification as an alternative to on-site audits, provided it covers the relevant Processing activities and controls.

13. Liability

Each party's liability for breaches of this Addendum shall be governed by the liability provisions of the Agreement, subject to the following:

• Processor's liability for Subprocessor acts/omissions is as if Processor remains fully liable;
• Liability for data protection fines imposed by Supervisory Authorities shall be allocated according to each party's responsibility for the violation;
• Neither party excludes liability for fraud, willful misconduct, or gross negligence.

14. Term and Termination

This Addendum takes effect on the Effective Date and continues for the duration of the Agreement. Upon termination or expiration of the Agreement, this Addendum remains in effect until all Personal Data has been deleted or returned per Section 11.

Either party may terminate this Addendum immediately if the other party commits a material breach of its data protection obligations and fails to cure such breach within 30 days of written notice.

15. General Provisions

• Amendments: This Addendum may be amended only in writing signed by both parties, or by Processor providing 30 days' written notice of changes that do not materially reduce data protection standards, provided Controller does not object.
• Governing Law: This Addendum is governed by the laws specified in the Agreement.
• Jurisdiction: Courts specified in the Agreement have exclusive jurisdiction.
• Severability: If any provision is held invalid, the remainder continues in force.
• No Third-Party Beneficiaries: This Addendum does not create rights for any third party except Data Subjects to the extent provided by GDPR.
• Counterparts: This Addendum may be executed in counterparts, each deemed an original.

Annex 1: Processing Details

Pursuant to Section 3.

Annex 2: Technical and Organizational Measures

Pursuant to Section 6 and Article 32 GDPR.

Annex 3: Approved Subprocessors

Pursuant to Section 7. Last updated: 2026-07-20.

Processor shall notify Controller of any changes to this list per Section 7. Subprocessors are engaged under written agreements containing data protection obligations no less protective than this Addendum.