Data Processing Addendum (DPA)

1. Introduction & Scope

This GDPR Data Processing Addendum ("DPA") forms part of the Terms of Service or Master Services Agreement available at subkit.io/terms(the "Agreement"), entered into by and between the Customer (the "data controller") and Subkit (the "data processor"), pursuant to which Customer has accessed Subkit Managed Cloud Services.

The purpose of this DPA is to reflect the parties' agreement with regards to the processing of Customer Data in accordance with the requirements of Data Protection Legislation (specifically Regulation (EU) 2016/679 - General Data Protection Regulation).

2. Definitions

3. Roles & Compliance

The parties agree that Customer is the **Data Controller** and that Subkit is its **Data Processor** in relation to Customer Data. Customer shall comply at all times with Data Protection Legislation in respect of all personal data it provides or configures to be processed by Subkit pursuant to the Agreement.

4. Processor Obligations

In respect of Customer Data processed under this DPA, Subkit agrees to:

• Documented Instructions: Process Customer Data only in accordance with the documented instructions from the Customer. If Subkit is required to process the personal data for any other purpose provided by applicable law, Subkit will inform the Customer prior to the processing unless prohibited on important grounds of public interest.
• Technical & Organizational Measures: Implement and maintain appropriate technical and organizational security measures designed to protect Customer Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure.
• Sub-Processors:Hire third-party sub-processors only under strict written agreements containing terms substantially similar to this DPA. Subkit remains fully responsible for its Sub-Processors' compliance with these obligations.
• Confidentiality: Ensure that all Subkit personnel required to access Customer Data are informed of its confidential nature and have entered into binding confidentiality agreements.
• Data Subject Rights Support:Assist the Customer (insofar as possible, and at Customer's request and cost) in responding to data subject rights requests under the GDPR, including requests for rectification, access, erasure, or portability of personal data.
• Data Erasure:At the end of the term of Managed Services, upon Customer's request, securely destroy or return to the Customer all Customer Data within Subkit's possession or control.
• Security Incident Notification:If Subkit becomes aware of any accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure of, or access to Customer Data (a "Security Incident"), it shall without undue delay notify the Customer and provide necessary details and mitigation updates.

5. Audits & Inspections

Subkit shall allow, no more than once every 12 months and at Customer's expense, the Customer or its authorized agents to conduct audits or inspections during the term of the Agreement, provided that Customer has given Subkit at least 30 days prior written notice. Such audit will be conducted during reasonable business hours with minimal disruption. For the avoidance of doubt, no direct logical access to Subkit's cloud networks, databases, or IT infrastructure hosting other customers will be permitted.