Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Developer312 and the Customer and supplements the Terms with respect to the processing of personal data.

This DPA applies where Developer312 processes personal data on behalf of the Customer in connection with the Eco-Auditor platform. It is intended to support GDPR-aligned controller-to-processor arrangements.

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of personal data.

Unless defined otherwise, terms used in this DPA have the meanings given in the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). Key definitions:

• "Customer" means the organization that has entered into a subscription agreement for the Eco-Auditor platform
• "Processor" means Developer312, acting on behalf of the Customer in processing personal data
• "Controller" means the Customer, which determines the purposes and means of processing personal data
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Subprocessor" means any third party engaged by Developer312 to process personal data on behalf of the Customer
• "Data Subject" means an identified or identifiable natural person whose personal data is processed

The Customer acts as the Controller of personal data. Developer312 acts as the Processor, processing personal data on the Customer's behalf and only in accordance with the Customer's documented instructions.

Where Developer312 decides on the purposes and means of processing its own employee or business data separate from the Customer's data, Developer312 acts as Controller for that processing.

The subject matter of processing is the hosting, storing, organizing, analyzing, and displaying of customer-submitted business data within the Eco-Auditor platform.

This DPA applies for the duration of the Customer's subscription and a post-termination retention period as specified in the Terms of Service, after which personal data is securely deleted in accordance with Section 12.

Developer312 shall process personal data only on documented instructions from the Customer, including:

• Instructions provided through the Eco-Auditor platform interface
• Instructions provided in writing (including email) by authorized Customer representatives
• Processing necessary to comply with applicable legal obligations

Developer312 shall not process personal data for its own purposes or for purposes not authorized by the Customer, unless required by applicable law, in which case Developer312 shall inform the Customer unless legally prohibited from doing so.

Developer312 ensures that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Developer312's employees and contractors are bound by confidentiality agreements and receive data protection training appropriate to their role.

Developer312 implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex II. These measures include:

• Role-based access controls and least-privilege access
• Encryption of personal data in transit (TLS 1.2+) and at rest
• Authentication and password controls including multi-factor authentication
• Logging, monitoring, and intrusion detection
• Backup and disaster recovery measures
• Environment segregation between production, staging, and development
• Vulnerability management and security patching
• Incident response procedures
• Employee confidentiality obligations and security training
• Secure deletion procedures

The Customer authorizes Developer312 to engage subprocessors to process personal data on the Customer's behalf. Developer312 ensures that subprocessors are bound by written agreements that impose data protection obligations no less protective than those in this DPA.

A current list of subprocessors is maintained in Annex III. Developer312 will notify the Customer of any addition or replacement of subprocessors, providing the Customer with a reasonable opportunity to object to such changes.

If the Customer objects to a subprocessor change and the parties cannot reach a resolution, the Customer may terminate the affected portion of the service or, if the change affects the entire service, terminate the subscription.

Developer312 shall assist the Customer in fulfilling its obligations to respond to data subject requests for exercising their rights under applicable data protection laws, including rights of access, rectification, erasure, portability, restriction, and objection.

Developer312 will promptly notify the Customer if it receives a data subject request directly and will not respond to such requests without the Customer's instructions, except as required by applicable law.

Developer312 shall notify the Customer without undue delay after becoming aware of a personal data breach, providing:

• The nature of the breach, including the categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects
• A designated point of contact for further information

Developer312 will cooperate with the Customer in investigating breaches and will provide all reasonably available information to assist the Customer in meeting its notification obligations under applicable law.

Upon termination of the service agreement, Developer312 will, at the Customer's choice:

• Return all personal data to the Customer in a structured, commonly used, machine-readable format; or
• Securely delete all personal data and certify such deletion in writing

This obligation does not apply where retention of personal data is required by applicable law, in which case Developer312 will continue to process such data only for the purpose and duration required by law.

Developer312 shall make available to the Customer all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Such audits shall be conducted during normal business hours with reasonable advance notice, and the Customer shall bear the cost of such audits unless they reveal a material breach of this DPA by Developer312.

Developer312 may process or access personal data outside the EEA, UK, or Switzerland depending on hosting, support, or infrastructure operations.

Where required, international transfers shall be governed by the Standard Contractual Clauses described in Section 14 and Annex IV.

Developer312 will ensure that any transfer of personal data to a third country is subject to appropriate safeguards as required by applicable data protection law.

Where personal data is transferred from the EEA, the parties agree to incorporate the Standard Contractual Clauses ("SCCs") as adopted by the European Commission, consisting of:

• Module Two (Controller to Processor): Where the Customer acts as Controller and Developer312 acts as Processor
• Module Three (Processor to Processor): Where both parties act as Processors in a chain of processing

The specific module(s) applicable will depend on the processing context. Annex IV provides the relevant SCC details and transfer information.

For transfers to the UK, the UK Addendum to the EU SCCs as approved by the UK Information Commissioner's Office shall apply as a supplementary measure.

Liability under this DPA shall be subject to the limitations and exclusions set out in the Terms of Service.

The order of precedence for conflicting terms shall be: (1) this DPA, (2) the Terms of Service, and (3) any other agreement between the parties with respect to the processing of personal data.

This DPA shall be governed by and construed in accordance with the laws specified in the Terms of Service.

Nothing in this DPA shall prejudice the data subject's rights under applicable data protection law.

Developer312 may update this DPA to reflect changes in applicable law, regulatory requirements, or data processing practices. Where the update represents a material change, Developer312 will provide the Customer with notice and an opportunity to review the updated terms.

Updated subprocessor information will be provided in accordance with Section 8.

Developer312 implements the following technical and organizational measures to protect personal data:

This is a summary of key measures. Detailed security documentation is available upon request under NDA. Developer312 does not overclaim certifications or controls not currently in place.

The following subprocessors are authorized to process personal data on behalf of the Customer:

Developer312 will notify the Customer of changes to this subprocessor list in accordance with Section 8 of this DPA. A current list is available upon request.

Where personal data is transferred outside the EEA/UK/Switzerland, the following applies:

Specific SCC annex details, including data exporter/importer information, competent supervisory authority, and governing law selections, shall be completed upon execution. This DPA does not constitute a signed SCC agreement until countersigned by both parties.