Data Processing Agreement

Capitalized terms that are not defined here have the meaning given in the Terms. In this DPA:

Data Protection Law

The GDPR and the laws of the EU and EEA Member States that implement or supplement it, Directive 2002/58/EC (the ePrivacy Directive) as implemented in national law, and, where they apply to the processing, the UK GDPR with the UK Data Protection Act 2018 and the Swiss Federal Act on Data Protection (“FADP”).

GDPR terms

“Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing”, “special categories of personal data” and “supervisory authority” have the meanings given in the GDPR.

Customer Personal Data

Personal data that we process on behalf of Customer when we provide the Service, as described in Annex I. It does not include personal data we process as a controller (see Section 1).

Service

ExitoMail hosted email, Exito Vault, Exito Transfer, custom domains and the organization administration features, as provided to Customer under the Terms.

Users

The people Customer allows to use the Service under its account, including the owner and members of Customer’s organization.

Subprocessor

Any third party we engage that processes Customer Personal Data. Our own employees, and individual contractors working under our direct authority, are not Subprocessors.

Security Incident

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Subprocessors. In other words, a personal data breach (Article 4(12) GDPR) affecting Customer Personal Data.

SCCs

The standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, completed as set out in Section 8.

Restricted Transfer

A disclosure of Customer Personal Data, by transmission or by making it available (including remote access), to a recipient in a country outside the European Economic Area (EEA) that is not covered by an adequacy decision under Article 45 GDPR (or, for UK or Swiss data, by the equivalent UK or Swiss adequacy rules).

Business Day

Monday to Friday, excluding US federal public holidays.

Order of precedence

If documents conflict, they apply in this order:

1. the SCCs, where they apply;
2. this DPA;
3. the Terms;
4. any other policy or document that forms part of our agreement with Customer.

Nothing in this DPA reduces the rights that Customer or data subjects have under Data Protection Law. Words such as “including” and “for example” introduce examples and do not limit the general words before them.

Subject matter

The processing of Customer Personal Data needed to provide the Service to Customer: hosting mailboxes on exitomail.com and on Customer's own domains, sending and receiving mail, storing and sharing files in Exito Vault, sending files by link with Exito Transfer, administering Customer's organization, and providing support.

Duration

For as long as we provide the Service to Customer under the Terms, and afterwards until the Customer Personal Data is deleted as described in Section 12.

Nature and purpose

The processing consists of hosting, storing, transmitting, receiving and delivering, filtering for spam and malware, indexing for search, backing up, restoring and deleting Customer Personal Data, and the related support and administration. We carry it out only to provide, maintain, secure and support the Service in line with Customer's instructions (Section 5).

Data subjects and types of personal data

In summary (the full description is in Annex I):

• Data subjects. Customer's Users; the people they correspond with; people who receive Exito Transfer links or upload files through “request files” links; people whose details Users store as contacts; and anyone mentioned in mail, files or transfers.
• Personal data. Mail content and metadata, contacts, Exito Vault files, Exito Transfer files and recipients' email addresses, account and authentication data, logs including IP addresses, and custom-domain and DNS configuration.

Customer is responsible for its use of the Service and, in particular:

• Lawful basis and transparency. Having a lawful basis for the processing (Article 6 GDPR and, where relevant, Article 9), and giving its Users and other data subjects the information required by Articles 13 and 14 GDPR.
• Lawful instructions. Making sure its instructions comply with Data Protection Law and with our Acceptable Use Policy.
• Users and configuration. Managing its Users (the owner and the members it invites), their mailboxes and addresses, sharing settings and link expiry, and deciding which data to put in the Service and how long to keep it. Customer should make sure Users protect their credentials and turn on two-step verification.
• Suitability. Assessing whether the Service, including the measures in Annex II and the fact that it is not end-to-end encrypted, is appropriate for the data Customer chooses to process with it, in particular special categories of personal data (Article 9 GDPR) and data relating to criminal convictions and offences (Article 10 GDPR).
• Its own systems. Securing its own devices, networks and mail clients, and any copies of data it exports from the Service.

Processing only on documented instructions

We process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to third countries, unless EU or Member State law to which we are subject requires otherwise. In that case, we inform Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest (Article 28(3)(a) GDPR). As a US company we are also subject to US law; requests from public authorities under it are handled as described in Section 14 and Clauses 14 and 15 of the SCCs.

Customer's documented instructions are:

• this DPA and the Terms;
• Customer's and its Users' use and configuration of the Service (for example, sending a message, sharing a file, setting a link to expire, adding a domain, or deleting a User or their data); and
• any other written instructions Customer gives us that are consistent with the Terms and that we confirm in writing. Instructions that go beyond what the Service does need our prior written agreement.

Instructions that infringe the law

We will inform Customer immediately if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions. We may suspend that instruction until Customer confirms or changes it. We are not obliged to carry out a full legal review of Customer's instructions.

Confidentiality of personnel

We give access to Customer Personal Data only to personnel who need it to provide, secure or support the Service (need-to-know), and only to the extent they need it. Everyone with access is bound by written confidentiality obligations, or is under an appropriate statutory obligation of confidentiality, that continue after their engagement ends, and receives security and data protection training.

Our personnel do not read the content of mail, files or transfers except where necessary: to provide support that Customer or a User has asked for, to investigate a security issue, abuse or an appeal, or to comply with the law. Such access is limited to what the task requires and is recorded in the related support or abuse case. Automated filtering and enforcement act on signals and scan results without personnel reading content.

Security

We implement and maintain the technical and organizational measures described in Section 6 and Annex II, as required by Article 32 GDPR.

No selling, no advertising, no other purposes

We do not sell, rent or share Customer Personal Data with anyone for advertising or marketing, we do not show ads, and we do not analyze content to profile Users. We do not use Customer Personal Data for our own purposes, except:

1. to produce aggregated, statistical operational metrics that do not identify Customer, its Users or any other person (for example, total storage used, message volumes and error rates), which we use to run the Service, plan capacity and improve reliability;
2. to keep the Service and its users secure and prevent abuse, to the extent necessary (for example, filtering spam and malware, enforcing sending limits and investigating abuse reports); and
3. to comply with the law.

Where processing under (b) or (c) makes us a controller, our Privacy Policy applies to it.

Records of processing

We keep a record of all categories of processing activities we carry out on behalf of our customers, as required by Article 30(2) GDPR, and make it available to a supervisory authority on request.

Cooperation with supervisory authorities

We cooperate with supervisory authorities in the performance of their tasks (Article 31 GDPR). Unless the law prohibits it, we tell Customer without undue delay about any inquiry or request from a supervisory authority that concerns Customer Personal Data.

Data protection contact

Questions about this DPA go to our privacy team at privacy@exitomail.com. We have not appointed a Data Protection Officer; the privacy team handles all data protection matters.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for the rights and freedoms of data subjects, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Article 32 GDPR). They are described in Annex II and, in plain language, on our Security page.

Our security program is modelled on ISO/IEC 27001:2022 and ISO/IEC 27701. We do not hold a certification under either standard, and nothing in this DPA should be read as claiming one.

Security evolves, so we may update these measures over time. We will not make changes that materially lower the overall level of protection of Customer Personal Data.

General authorization

Customer gives us general written authorization to engage Subprocessors (Article 28(2) GDPR). Our current Subprocessors are listed in Annex III and on our Subprocessors page. Customer authorizes all of them, including those marked as planned or conditional, which receive data only once the related feature launches or is switched on.

Notice of changes

We inform Customer at least 30 days before a new or replacement Subprocessor starts processing Customer Personal Data, by email to Customer's account owner and by updating the Subprocessors page. Anyone can also subscribe to these updates by writing to privacy@exitomail.com with the subject “Subprocessor updates”.

Right to object

Customer may object to a new or replacement Subprocessor within that 30-day period, in writing to privacy@exitomail.com, on reasonable grounds relating to data protection. We will then discuss the concern with Customer in good faith and try to resolve it, for example by explaining the safeguards in place or by offering a way to use the Service without that Subprocessor processing Customer's data.

If we cannot resolve the objection within a reasonable time, Customer may terminate the affected part of the Service (or the whole Service, if the affected part cannot reasonably be used on its own) by written notice, and we will refund any fees Customer has prepaid for the period after termination, on a pro-rata basis. This is Customer's remedy for an unresolved objection, without prejudice to its rights under Data Protection Law and the SCCs.

Urgent replacements

If we must replace a Subprocessor urgently for reasons outside our control (for example, a provider's sudden failure or a security risk), we may do so with shorter notice to the extent the SCCs and Data Protection Law allow. We will inform Customer as soon as possible, and the right to object above applies from that notice.

Our responsibility for Subprocessors

• Equivalent obligations. We engage each Subprocessor under a written contract that imposes data protection obligations no less protective than those in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures (Article 28(4) GDPR).
• Due diligence. We assess each Subprocessor's security and data protection practices before engaging it, and review them periodically.
• Liability. We remain fully liable to Customer for the performance of each Subprocessor's obligations.
• Copies. On request, we provide Customer with a copy of the data protection terms we have agreed with a Subprocessor. We may remove commercial information or confidential details first.

Data stays in the EU

We store Customer Personal Data in the European Union:

Some of our Subprocessors are established in the United States (see Annex III), so access to data from outside the EEA (for example, for maintenance or support) cannot be excluded. In addition:

• Our website and the web app at exitomail.com (including webmail, Exito Vault and Exito Transfer screens used in a browser) are delivered through Cloudflare's global network. Cloudflare terminates the encrypted connection at its edge, so that traffic, including mail and files opened in the web app, may pass through data centres outside the EEA while it is in transit.
• Mail delivery and mail apps (SMTP, IMAP and JMAP on mail.exitomail.com) connect directly to our server and never pass through Cloudflare.
• Exito Vault and Exito Transfer files are uploaded and downloaded by the browser directly to and from object storage (Wasabi and Cloudflare R2) using short-lived signed links, so those providers also see the IP addresses of the people uploading and downloading.

When Users send mail or transfers to recipients outside the EEA, those disclosures are made on Customer's instructions, as part of the Service Customer has chosen to use.

Standard Contractual Clauses between Customer and us

We are established in the United States, which is not covered by an adequacy decision for us (we are not certified under the EU–U.S. Data Privacy Framework). When Customer is subject to the GDPR, making Customer Personal Data available to us is therefore a Restricted Transfer, even though the data is stored in the EU (EDPB Guidelines 05/2021, Example 11). The SCCs are incorporated into this DPA by reference and apply to it. Customer is the “data exporter” and we are the “data importer”, and they are completed as follows:

Onward transfers to Subprocessors

Where one of our Subprocessors processes Customer Personal Data in a way that is a Restricted Transfer, we make sure the transfer is covered by a valid mechanism under Chapter V GDPR and Clause 8.8 of the SCCs: either the SCCs (Module 3, processor to processor) or, where the recipient is certified under the EU–U.S. Data Privacy Framework, the adequacy decision adopted by the Commission on 10 July 2023 (Implementing Decision (EU) 2023/1795). Cloudflare, Inc. is certified; Wasabi Technologies LLC is not, so the SCCs apply to it. The mechanism used for each Subprocessor is shown in Annex III.

US law and transfer impact assessment

As a US provider of electronic communication and remote computing services, we can be required by US law to disclose data in our possession, custody or control, wherever it is stored (for example under 18 U.S.C. § 2713). We assess, as Clause 14 of the SCCs requires, how US laws and practices could affect our ability to meet our obligations, taking into account the safeguards that the Commission assessed in its adequacy decision of 10 July 2023, and we apply the supplementary measures in Annex II and Section 14. A summary is available to Customer on request.

UK and Swiss data

• United Kingdom. For Restricted Transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force since 21 March 2022) applies, with Tables 1 to 3 completed by the information in this DPA and its Annexes. For Table 4, both the importer and the exporter may end the Addendum as set out in its Section 19. The Addendum is governed by the law of England and Wales, and disputes go to the courts of England and Wales.
• Switzerland. For Restricted Transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term “Member State” does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence (Clause 18(c)).

Taking into account the nature of the processing, we assist Customer with appropriate technical and organizational measures, insofar as this is possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection) (Article 28(3)(e) GDPR).

Self-service tools

Most requests can be handled directly in the Service:

• Access and portability. Users can download their mail with any standard mail client over IMAP, and download their Exito Vault files. Organization data can also be exported with our help on request.
• Rectification. Users can correct their own profile details.
• Erasure. Users can delete messages, files and transfers, and the owner can delete a member’s mailbox together with its data, after 30 days in which it can be restored. Deleted items are removed as described in Section 12 and Annex I.

Requests we receive directly

If a data subject sends us a request that relates to Customer Personal Data, we will not respond to it ourselves, except to tell the person that we have passed it on or to direct them to Customer. We forward the request to Customer without undue delay, provided we can identify Customer from the request.

Further assistance

Where the tools are not enough, we provide reasonable additional assistance on request. If a request would need substantial effort on our part, we may charge reasonable costs, which we agree with Customer in advance.

Taking into account the nature of the processing and the information available to us, we assist Customer in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments (Article 35) and prior consultations with supervisory authorities (Article 36).

We do this mainly by making documentation available, namely this DPA and its Annexes, our Security page, our Subprocessors page and information about international transfers, and by answering Customer's reasonable questions about the processing.

Notification

We notify Customer of a Security Incident without undue delay after becoming aware of it, and in any event within 72 hours of becoming aware of it. We send the notification to the email address of Customer's account owner and to any other contact Customer has given us in writing for this purpose.

What the notification contains

To the extent the information is available, the notification describes (Article 33(3) GDPR):

• the nature of the Security Incident, including, where possible, the categories and approximate number of data subjects and records concerned;
• the name and contact details of the contact point where Customer can get more information;
• the likely consequences of the Security Incident; and
• the measures we have taken or propose to take to address it, including measures to mitigate its possible adverse effects.

Where we cannot provide all of this at once, we provide it in phases, without undue further delay, as our investigation progresses.

Our response

We promptly take reasonable steps to contain and investigate the Security Incident, to mitigate its effects and to prevent it from happening again. We document the facts, effects and remedial action taken, and give Customer reasonable assistance with its own obligations.

Customer's responsibilities

As controller, Customer remains responsible for deciding whether to notify, and for notifying, supervisory authorities and affected data subjects (Articles 33 and 34 GDPR). We do not notify third parties about a Security Incident affecting Customer Personal Data on Customer's behalf, unless Customer asks us to or the law requires it.

No admission of fault

Notifying or responding to a Security Incident is not an acknowledgment by us of any fault or liability.

What is not a Security Incident

Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, failed sign-in attempts, or denial-of-service attacks that do not lead to unauthorized access or loss of data, do not require notification.

Export at any time

Customer can export Customer Personal Data at any time while it uses the Service:

• Mail. over IMAP, with any standard mail client;
• Exito Vault. by downloading files and folders;
• Organization data. with our help on request.

Customer should export the data it wants to keep before the Service ends. If Customer needs help with this, we provide reasonable assistance on request made before the end of the Service.

Deletion after the end of the Service

When the Service ends for Customer (or when Customer asks us to delete its account), we delete Customer Personal Data from our active systems, and from those of our Subprocessors, within 30 days.

Copies in our database backups are deleted as the backups rotate out, within 30 days. Until then, backups stay encrypted and protected by the measures in Annex II, and are used only to recover from a disaster. If we ever have to restore a backup, we delete again any data that had already been deleted.

Confirmation

On request, we confirm the deletion to Customer in writing (a deletion certificate).

Retention required by law

We keep Customer Personal Data after the end of the Service only where EU or Member State law requires us to store it (Article 28(3)(g) GDPR), or where it is subject to a legal hold described in our Acceptable Use Policy, such as material we must preserve after reporting it to NCMEC. In that case, we keep it confidential, process it only for the purpose concerned, and delete it when that obligation ends.

Information we make available

We make available to Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA (Article 28(3)(h) GDPR), including:

• this DPA and the technical and organizational measures in Annex II;
• our Security overview and, on request and under confidentiality, the relevant security and data protection policies;
• our list of Subprocessors and a copy of their data protection terms (see Section 7);
• a summary of the third-party certifications or audit reports that our Subprocessors publish or make available to us, where available; and
• written answers to Customer's reasonable questions, including one security questionnaire per year.

Audits and inspections

If that information is not enough to demonstrate compliance, we allow for and contribute to audits, including inspections, by Customer or by an independent auditor Customer appoints, under these conditions:

• Auditor. The auditor is bound by written confidentiality obligations and is not a competitor of ours.
• Notice and frequency. Customer gives us at least 30 days' written notice, with a proposed scope, and audits take place no more than once in any 12-month period.
• Conduct. Audits take place remotely or on site, during our Business Days and normal business hours, in a way that does not disrupt the Service or give access to other customers' data. Facilities operated by our Subprocessors are audited through the reports and information those Subprocessors make available.
• Cost. Customer bears its own costs and the auditor's costs. If an audit would need significant time from us, we may ask Customer to cover our reasonable costs, which we agree in advance.
• Results. Customer shares the audit report with us, treats it as confidential, and uses it only to verify compliance with this DPA. We address any material findings within a reasonable time.

The notice and frequency limits do not apply where a supervisory authority requires the audit, or after a Security Incident affecting Customer Personal Data. Audits under the SCCs are carried out in the same way, to the extent consistent with the SCCs.

If we receive a legally binding request from a public authority (including a law enforcement or national security authority) for disclosure of, or access to, Customer Personal Data, we:

1. try to redirect the authority to request the data directly from Customer;
2. notify Customer promptly and, where possible, provide a copy of the request, unless the law prohibits this; if it does, we use reasonable efforts to obtain a waiver of the prohibition so that we can inform Customer as soon as possible;
3. review the legality of the request and challenge it where, after careful assessment, we conclude there are reasonable grounds to consider it unlawful, overbroad or inconsistent with the law of the country of destination or of the EU, and pursue available appeals;
4. disclose only the minimum data permissible when responding, based on a reasonable interpretation of the request; and
5. document the request, our assessment and our response.

We have not built, and will not voluntarily build, back doors into the Service, and we do not give any public authority direct or bulk access to Customer Personal Data. Because we are a US company, these commitments apply in particular to requests under US law. Where the SCCs apply, Clause 15 also governs these requests. Orders under Articles 9 and 10 of the Digital Services Act are handled as described in our Notice & Action policy.

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, as if this DPA were part of them.

Nothing in this DPA or the Terms limits or excludes:

• any liability towards data subjects under Article 82 GDPR, or their rights as third-party beneficiaries under the SCCs;
• either party's liability under the SCCs, to the extent the SCCs do not allow it to be limited; or
• any liability that cannot be limited or excluded under applicable law.

This DPA takes effect when Customer accepts the Terms (or, for an existing customer, when it first processes Customer Personal Data through the Service) and remains in force for as long as we process Customer Personal Data. It survives the termination of the Terms until all Customer Personal Data has been deleted as described in Section 12.

If we can no longer comply with this DPA, we will inform Customer promptly. Customer may then suspend the affected processing and, if we do not restore compliance within a reasonable time, terminate the affected part of the Service, with a pro-rata refund of any fees prepaid for the period after termination.

Governing law and jurisdiction

Where Customer is subject to the GDPR, this DPA is governed by the same law as the SCCs under Clause 17 (see Section 8), so that it is a contract under Member State law as Article 28(3) GDPR requires, and disputes arising from it go to the courts chosen under Clause 18. Where only the UK GDPR applies, it is governed by the law of England and Wales. In all other cases, it is governed by the laws of the State of Florida, United States, and the state and federal courts located in Miami-Dade County, Florida have jurisdiction, as set out in the Terms.

Changes to this DPA

We may update this DPA to:

• reflect changes in Data Protection Law, guidance from authorities or courts, or new standard contractual clauses;
• reflect changes to the Service that do not reduce the protection of Customer Personal Data; or
• clarify its wording.

We announce material changes at least 30 days before they take effect, by email to Customer's account owner and on this page. Changes never reduce the overall protection of Customer Personal Data. Previous versions are available on request.

Notices

Customer sends notices under this DPA to privacy@exitomail.com. We send notices to the email address of Customer's account owner.

Severability

If any provision of this DPA is found invalid or unenforceable, the rest of it remains in effect, and the provision is replaced by a valid one that comes as close as possible to its original intent.

A. List of parties

Data exporter (controller, or processor on behalf of its own controller)

Name and address

Customer, as identified by the organization name, contact and billing details provided at sign-up or in Settings.

Contact person

Customer’s account owner, or another contact Customer gives us in writing.

Activities

Use of the Service (ExitoMail, Exito Vault, Exito Transfer and custom domains) for its business purposes.

Role

Controller (SCC Module 2) or processor (SCC Module 3).

Signature and date

Acceptance of the Terms, including this DPA, on the date of acceptance.

Data importer (processor)

Name and address

EXITO Media LLC, a Wyoming limited liability company (Wyoming Secretary of State, filing ID 2022-001141268), with its business address at 111 NE 1st St, 8th Floor, #88287, Miami, FL 33132, United States

Contact

privacy@exitomail.com

Data Protection Officer

Not appointed. The privacy team handles data protection matters.

Representative in the EU (Article 27 GDPR)

Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: datarequest@datarep.com (put “EXITO Media LLC” in the subject). Online form: datarep.com/data-request (נפתח בכרטיסייה חדשה). It also has an address in every other EU and EEA country: see all addresses.

Activities

Providing the Service to Customer under the Terms.

Role

Processor (SCC Module 2) or sub-processor (SCC Module 3).

Signature and date

As for the data exporter.

B. Description of the processing

Categories of data subjects

• Users. The owner and members of Customer's organization, and anyone else Customer gives an account.
• Correspondents. People who send mail to, or receive mail from, Users.
• Contacts. People whose details Users store in their contacts, messages or files.
• Transfer and share recipients. People who receive Exito Transfer links or Exito Vault share links from Users, and people who upload files to Users through “request files” links.
• People mentioned in content. Anyone named or described in mail, files or transfers.

Categories of personal data

• Mail. Message bodies and attachments, subject lines, sender and recipient addresses, headers (including the IP addresses of sending servers), dates, folders, flags and search indexes.
• Contacts. Names, email addresses and other details Users store.
• Exito Vault. Files and folders, their names, sizes and types, and share links with their settings.
• Exito Transfer. Files, file names and sizes, recipients' email addresses, messages to recipients, link settings and download events (download receipts).
• Account data. Names, addresses and aliases, recovery email, roles and organization membership, settings, and authentication data (password hashes and two-factor secrets).
• Logs. IP addresses, browser and client information, timestamps, sign-in events, request and mail delivery logs, and the audit log of administrative actions.
• Domain data. Custom domain names, DNS records and verification status, DKIM keys, and any DNS-provider credentials Customer chooses to provide for automatic setup.

Sensitive data

We do not ask for or intend to process special categories of personal data. Customer and its Users may nevertheless include such data in mail, files or transfers. The same measures (Annex II) protect all content: restricted staff access, TLS in transit, encryption at rest in object storage, and no analysis of content other than automated spam and malware filtering and indexing for search.

Frequency of the transfer

Continuous, for as long as Customer uses the Service.

Nature of the processing

Hosting, storage, transmission, receipt and delivery of mail, spam and malware filtering, indexing for search, backup, restoration, deletion, and related support and administration.

Purpose of the processing

Providing, maintaining, securing and supporting the Service for Customer, in line with Customer’s instructions.

Retention

As set out in the table below.

Transfers to Subprocessors

To the Subprocessors listed in Annex III, for the subject matter, nature and duration described there and in this Annex.

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs, as set out in Section 8. Because we have no establishment in the EU, we have no lead supervisory authority of our own.

These are the technical and organizational measures we implement under Article 32 GDPR and Clause 8.6 of the SCCs. Our security program is modelled on ISO/IEC 27001:2022 and ISO/IEC 27701; it is not certified. The references show which ISO/IEC 27001:2022 Annex A controls each measure supports. We review these measures at least once a year, and after significant changes or incidents.

A.5 Organizational controls

A.6 People controls

A.7 Physical controls

A.8 Technological controls

Measures to assist Customer

• Self-service tools to access, export, correct and delete data (Section 9).
• Breach notification without undue delay and within 72 hours of becoming aware (Section 11).
• Documentation for impact assessments and audits (Section 10 and Section 13).

Measures of Subprocessors

Each Subprocessor must implement measures that provide at least the level of protection described in this Annex for the processing it carries out, as set out in our written agreement with it (Section 7).

Customer authorizes the following Subprocessors. The same list, with any announced changes, is published on our Subprocessors page. Changes follow the process in Section 7.