Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between ComplyPages and the customer where the parties agree that this DPA applies.

ComplyPages is operated by Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.

This DPA applies where ComplyPages processes personal data on behalf of a customer as a processor in connection with ComplyPages services.

In this DPA:

For business contact data, billing data, marketing data, website analytics, and service administration data, ComplyPages may act as an independent controller as described in our Privacy Policy.

For Customer Personal Data processed solely to provide paid scan, report, retest, monitoring, or related services on behalf of the Customer, the Customer is the controller and ComplyPages is the processor, unless otherwise agreed in writing.

ComplyPages will process Customer Personal Data only:

The Customer’s instructions include processing necessary to provide snapshots, fix packs, reports, retests, monitoring, support, security, and related service administration.

If ComplyPages believes an instruction infringes applicable data protection law, we will inform the Customer where legally permitted.

The Customer is responsible for:

ComplyPages may process Customer Personal Data to:

Customer Personal Data may include:

ComplyPages does not intentionally collect special category personal data, payment card data, private customer account data, or sensitive form data as part of standard public-flow scanning.

Data subjects may include:

Processing continues for the duration of the agreement and any retention period described in the agreement, Privacy Policy, or service record.

Unless otherwise agreed, scan reports and related materials may be retained for up to 24 months after delivery or last customer interaction, and longer where needed for legal, accounting, dispute, security, or audit purposes.

ComplyPages will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

ComplyPages will implement appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Measures may include access controls, limited personnel access, secure hosting practices, provider due diligence, encryption in transit where supported, account and credential controls, logging and monitoring, backup and recovery measures where applicable, internal data-handling procedures, incident review procedures, and subprocessor management.

Additional details are provided in Annex II.

The Customer authorises ComplyPages to use subprocessors to provide the services.

ComplyPages will use subprocessors under appropriate contractual obligations. Where required, ComplyPages will impose data protection obligations on subprocessors that are materially similar to those in this DPA.

ComplyPages may update its subprocessor list from time to time. If required by the applicable agreement, Customers may object to a new subprocessor on reasonable data protection grounds.

Where Customer Personal Data is transferred outside the European Economic Area, ComplyPages will use appropriate transfer safeguards where required, such as adequacy decisions, Standard Contractual Clauses, or equivalent measures.

Taking into account the nature of the processing, ComplyPages will provide reasonable assistance to the Customer for responding to data subject requests where the Customer cannot reasonably fulfil the request without ComplyPages’ assistance.

If ComplyPages receives a request directly from a data subject relating to Customer Personal Data, we may direct the request to the Customer unless legally required to respond.

Taking into account the nature of the processing and information available to ComplyPages, we will provide reasonable assistance with security obligations, personal data breach obligations, data protection impact assessments, and supervisory authority consultations where required by applicable data protection law and where the Customer cannot reasonably meet the obligation without ComplyPages’ assistance.

If ComplyPages becomes aware of a personal data breach affecting Customer Personal Data, we will notify the Customer without undue delay.

The notification will include available information reasonably required for the Customer to meet its obligations, such as the nature of the incident, affected data categories, likely consequences, and measures taken or proposed.

At the end of the services, and upon written request, ComplyPages will delete or return Customer Personal Data where required and reasonably possible, unless retention is required by law, legitimate business record needs, security, dispute resolution, or backup/archive systems.

ComplyPages will make available reasonable information necessary to demonstrate compliance with this DPA.

Audits must be reasonable, limited, non-disruptive, subject to confidentiality, and not compromise the security or confidentiality of other customers or systems. ComplyPages may satisfy audit requests through security documentation, policies, summaries, or third-party reports where appropriate.

Liability under this DPA is subject to the limitations and exclusions of liability in the applicable agreement, unless prohibited by applicable law.

If there is a conflict between this DPA and the main agreement regarding data protection, this DPA will control to the extent of the conflict.

Privacy contact: privacy@complypages.com Legal contact: legal@complypages.com General contact: hello@complypages.com

Operator: Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.

---