Data Processing Agreement

DATAFIREFLY LIMITED

Data Processing Agreement (DPA)

Article 28 GDPR, Controller / Processor Relationship

Version 1.0, Effective from 18 April 2026

This Data Processing Agreement ("DPA") is entered into between:

• DATAFIREFLY LIMITED, a company incorporated under the laws of Ireland under registration number 810100, with its registered office at 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8, acting as Processor within the meaning of the GDPR (hereinafter the "Processor" or "Datafirefly"), represented at [email protected];
• And the business Client identified either in the main contract or signed order form, or: for services subscribed to online: by the account created at signup and the Terms accepted on that occasion, acting as Controller (hereinafter the "Controller" or the "Client").

Each individually a "Party" and collectively the "Parties".

Preamble

In the context of services subscribed to by the Client from Datafirefly (SaaS platforms, hosted modules, integrations, Data Hub, consulting, maintenance), Datafirefly processes personal data on behalf of the Client. This DPA frames such processing in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and the guidelines of the European Data Protection Board (EDPB).

This DPA prevails over any data protection clause in the General Terms and Conditions in the event of conflict. It supplements those terms without replacing them on other aspects.

Article 1, Definitions

Terms used in this DPA have the meaning given to them by the GDPR, notably: "personal data", "processing", "controller", "processor", "data subject", "personal data breach", "transfer", "supervisory authority", "third countries", "standard contractual clauses".

Article 2: Subject matter and scope of processing

2.1 The Controller entrusts the Processor, strictly within the performance of the main contract, with the processing of personal data described in Annex 1 of this DPA.

2.2 The Processor processes such data only on documented instructions from the Controller. The main contract, the parameters configured by the Client within the services, this DPA and any written order from the Controller constitute documented instructions.

2.3 If the Processor considers that an instruction from the Controller infringes the GDPR or any other Union or Member State data protection law, it shall inform the Controller without delay.

Article 3: Duration of processing

3.1 This DPA enters into force on the date of acceptance of the main contract and remains in force as long as the Processor processes personal data on behalf of the Controller.

3.2 The Processor's obligations survive the end of processing for the purposes of returning or deleting data as set out in Article 11.

Article 4, Obligations of the Processor

In accordance with Article 28 GDPR, the Processor undertakes to:

• Process personal data only on documented instructions from the Controller, including with regard to transfers outside the European Economic Area, unless required to do so by Union or Member State law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless legally prohibited from doing so
• Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Implement appropriate technical and organisational measures to ensure the security of processing (Article 32 GDPR), as described in Annex 2
• Respect the conditions for engaging sub-processors (Article 6 of this DPA)
• Assist the Controller, by appropriate measures, in fulfilling its obligation to respond to data subject requests (Articles 12 to 23 GDPR)
• Assist the Controller in complying with obligations relating to security of processing, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR)
• At the end of the services, at the Controller's choice, delete or return all personal data and delete existing copies unless Union or Member State law requires storage
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR obligations and allow for audits, in accordance with Article 10 of this DPA

Article 5, Obligations of the Controller

The Controller shall:

• Have a valid legal basis for each processing activity entrusted to the Processor (Article 6 GDPR)
• Inform data subjects in accordance with Articles 13 and 14 GDPR
• Collect and keep proof of consent where required
• Give clear, documented and GDPR-compliant instructions
• Provide the Processor only with data strictly necessary to perform the services (minimisation)
• Not transmit any sensitive data within the meaning of Article 9 GDPR without first informing the Processor and, if necessary, signing a specific addendum

Article 6, Sub-processors

6.1 The Controller expressly authorises the Processor to engage the sub-processors listed in Annex 3 of this DPA.

6.2 The Processor shall inform the Controller in writing of any intended addition or replacement of a sub-processor, with a minimum notice period of 30 calendar days. The Controller may object to such change on legitimate data protection grounds. In case of objection, the Parties shall seek a good-faith solution; failing which, the Controller may terminate the main contract without penalty.

6.3 The Processor remains fully liable to the Controller for the performance of obligations by sub-processors. It shall enter into a contract with each sub-processor imposing equivalent data protection obligations.

Article 7: Transfers outside the European Economic Area

7.1 Any data transfer outside the EEA shall be carried out in accordance with Chapter V of the GDPR. Applicable safeguards are described in Annex 4.

7.2 The Processor gives preference, where possible, to recipients located within the EEA or in a country benefiting from an adequacy decision from the European Commission.

7.3 For transfers to third countries not recognised as adequate, the Processor implements Standard Contractual Clauses ("SCC") adopted by the European Commission, or any other compliant transfer mechanism (binding corporate rules, codes of conduct, certification).

7.4 The Processor carries out, where required, a Transfer Impact Assessment and implements the supplementary measures necessary to ensure a level of protection essentially equivalent to that of the EEA.

Article 8, Security of processing

8.1 The Processor implements the appropriate technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and, where relevant, at rest
• Access control based on the least-privilege principle
• Strong authentication for administrators and operators
• Logging and monitoring of access and operations
• Regular, tested and isolated backups
• Business continuity and disaster recovery procedures
• Staff awareness and training

8.2 Security measures are periodically reviewed and may be strengthened by the Processor at any time as part of continuous improvement. They may not be degraded without the Controller's agreement.

Article 9: Personal data breach

9.1 The Processor shall notify the Controller of any personal data breach within a maximum of 48 hours after becoming aware of it, by email sent to the privacy contact designated by the Controller.

9.2 The notification shall include, to the extent possible:

• Description of the nature of the breach, categories and approximate number of data subjects and records concerned
• Contact details of the data protection officer or contact point
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects

9.3 The Processor shall fully cooperate with the Controller, in particular to enable it to fulfil its notification obligations to the supervisory authority (Article 33 GDPR) and, where applicable, to communicate to data subjects (Article 34).

Article 10, Audit and inspection

10.1 The Processor shall make available to the Controller, upon written request, all information necessary to demonstrate compliance with its GDPR obligations: security policies, certifications, recent external audit reports, test results.

10.2 The Controller may perform, at its own cost and with reasonable prior notice of 30 calendar days, an annual audit of security measures and processing operations. The audit shall be carried out during business hours, in conditions that do not disrupt operations, and while respecting the confidentiality of other clients.

10.3 In case of legitimate suspicion of serious breach, an exceptional audit may be carried out with 10 business days' notice. Findings may give rise to corrective action plans.

10.4 The Controller may appoint an independent third party to carry out the audit, provided that the third party is subject to an equivalent confidentiality obligation and is not a direct competitor of the Processor.

Article 11: End of processing and fate of data

11.1 Upon termination or expiry of the main contract, the Processor shall, on written instruction from the Controller and within a maximum of 30 calendar days, either return the data to the Controller in a commonly used and machine-readable electronic format or permanently delete it.

11.2 In the absence of instruction from the Controller upon expiry of the 30-day period, the Processor shall delete the data.

11.3 The Processor may retain copies strictly to the extent necessary to comply with a legal obligation (accounting, disputes). Such copies shall remain subject to the same security and confidentiality obligations.

11.4 The Processor shall provide, upon request, a deletion certificate.

Article 12: Liability and limitation

12.1 Each Party is liable for damages caused by processing that does not comply with the GDPR, under the conditions set out in Article 82 GDPR.

12.2 The Processor's liability under this DPA is capped in accordance with the provisions of the General Terms and Conditions, save for mandatory statutory provisions to the contrary, in particular administrative fines imposed by the supervisory authority.

12.3 The Parties undertake to cooperate in good faith in the event of contentious or administrative proceedings relating to data protection.

Article 13: General provisions

13.1 This DPA is governed by Irish law, in accordance with the General Terms and Conditions. Any dispute is submitted to the competent courts of Dublin.

13.2 The annexes form an integral part of this DPA. In the event of conflict between the body of the DPA and its annexes, the body of the DPA prevails.

13.3 Any amendment to the DPA shall be the subject of a written amendment signed by both Parties. The Processor may, however, unilaterally update Annex 3 (sub-processors) in accordance with the procedure set out in Article 6.

13.4 The invalidity of a clause does not affect the validity of the other clauses.

Annex 1, Description of processing

Annex 2: Technical and organisational security measures

Technical measures

• TLS 1.2 minimum encryption for all external communications (mandatory HTTPS)
• Password hashing using a robust cryptographic function (bcrypt or equivalent)
• Strong two-factor authentication for administrator access
• Logical segregation of environments (production, staging, development)
• Isolation of client databases with application-level access controls
• Automated daily backups, retained for at least 30 days, stored on separate infrastructure
• Application firewall and anti-DDoS protection at hosting provider level
• Security updates applied within reasonable time after patch publication
• Logging of administrator accesses and sensitive operations
• Antivirus and monitoring of administrator access workstations

Organisational measures

• Access management policy based on the least-privilege principle
• Confidentiality undertaking signed by each staff member with data access
• Staff awareness and data protection training
• Documented incident and breach management procedure
• Annual review of security measures and access rights
• Documented business continuity and disaster recovery procedures
• Contracts with sub-processors imposing equivalent data protection obligations

Annex 3, Authorised sub-processors

The list of sub-processors is updated by the Processor in accordance with the procedure in Article 6. The version in force on the effective date of this DPA is:

Annex 4: Transfers outside EEA and safeguards

For recipients located outside the EEA and not covered by an adequacy decision, the Processor implements the Standard Contractual Clauses (SCC) adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented where appropriate by additional measures (end-to-end encryption, pseudonymisation, access restrictions, legal risk assessment of local laws).

The Processor shall make available to the Controller, upon written request, the references of the SCC signed with each relevant sub-processor and the results of the Transfer Impact Assessments carried out.

Official document

DATAFIREFLY LIMITED

Reg. No. 810100: 15A Main Street, Blackrock, Dublin, Ireland, A94T8P8

DPA: Version 1.0: April 2026