Preamble

1. Definitions

2.  Roles and scope of processing

2.3 Part A (General Data Protection Terms) applies to all processing. Part B (International Transfers and Region-Specific Terms) applies additionally where the relevant law identified in it applies. In case of conflict, Part B prevails over Part A, and the Standard Contractual Clauses prevail over both in respect of Restricted Transfers.

2.4 Joint controllership for operational data. The IP is operated jointly by XSolutions and Niebo Solutions (Poland). Notwithstanding XSolutions' role as Processor, for certain data processed for the security and analytics of the IP (e.g., account identity and usage logs), XSolutions and Niebo act as joint controllers under Article 26 GDPR. This is limited to technical platform operation and does not grant XSolutions or Niebo any ownership or control over the Tenant's business data described in Annex 1. Processing of such security and analytics data by XSolutions and Niebo is governed by a joint-controller arrangement between XSolutions and Niebo and is described in the IP privacy notice (which sets out the essence of that arrangement and the contact points). XSolutions' obligations as the Processor in this DPA do not apply to aforementioned security and analytics data, and a data subject may exercise their rights in respect of that data against either joint controller.

3.  Processing on documented instructions

3.1 XSolutions shall process the Tenant Personal Data only on the Tenant's documented instructions, including with regard to international transfers, unless required by law (in which case XSolutions shall, where legally permitted, inform the Tenant first). The Agreement and this DPA (including Annex 1) constitute the Tenant's complete and final documented instructions.

3.2 XSolutions shall immediately inform the Tenant if, in its opinion, an instruction infringes Applicable Data Protection Law.

4.  Confidentiality

5. Security of processing

5.1 XSolutions shall implement and maintain the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, taking into account Article 32 GDPR (and equivalent requirements).

5.2 XSolutions may update those measures from time to time provided the overall level of security is not diminished.

5.3 The Tenant is responsible for the security measures within its own control, including safeguarding the access credentials used for the IP and determining whether to enable multi-factor authentication for its users.

6.  Sub-processing

6.1 The Tenant grants XSolutions general written authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 3.

6.2 XSolutions shall give the Tenant at least 30 days' prior notice of the addition or replacement of any Sub-processor by updating its online Sub-processor list, enabling the Tenant to object on reasonable data-protection grounds. If the Tenant objects, the parties shall work in good faith to resolve the objection; failing resolution, either party may terminate the affected Services in accordance with the Agreement.

6.3 XSolutions shall impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA and shall remain liable for each Sub-processor's performance.

7.  Assistance with Data Subject rights

7.1 Taking into account the nature of the processing, XSolutions shall assist the Tenant by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights. If XSolutions receives such a request directly, it shall promptly inform the Tenant and direct the Data Subject to the Tenant.

8.  Personal Data Breach

8.1 XSolutions shall notify the Tenant without undue delay after becoming aware of a Personal Data Breach affecting the Tenant Personal Data, and shall provide reasonable information and cooperation to assist the Tenant in meeting its breach-notification obligations under Articles 33–34 GDPR (and equivalent laws).

9.  Data protection impact assessments

9.1 XSolutions shall provide reasonable assistance to the Tenant with data protection impact assessments and prior consultations with supervisory authorities (Articles 35–36 GDPR), taking into account the information available to XSolutions, including the measures in Annex 2.

10.  Return or deletion of data

10.1 Upon termination or expiry of the Agreement, XSolutions shall, at the Tenant's choice, delete or return the Tenant Personal Data and delete existing copies, unless retention is required by law or permitted under the Agreement's data-retention terms. Retention periods are described in Annex 1.

11.  Audits and information

11.1 XSolutions shall make available to the Tenant information reasonably necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Tenant or an auditor it mandates. XSolutions may satisfy this obligation by providing relevant third-party certifications and audit reports (for example, the SOC 2 and ISO/IEC 27001 reports of its hosting Sub-processor) subject to confidentiality.

12.  European Economic Area (EU GDPR)

12.1 Where the EU GDPR applies, the EU SCCs are incorporated by reference and completed as follows:

(a) Module Two (Controller-to-Processor) applies; where the Tenant is a Processor and XSolutions is a Sub- processor, Module Three (Processor-to-Processor) applies instead;

(b) in Clause 7, the optional docking clause applies;

(c) in Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in clause 6.2 of this DPA;

(d) in Clause 11, the optional independent dispute-resolution language does not apply;

(e) in Clause 17 (Option 1), the EU SCCs are governed by the law of the EU Member State in which the data exporter is established; where the exporter is not established in an EU Member State, they are governed by the law of Ireland;

(f) in Clause 18(b), disputes shall be resolved before the courts of that Member State (or, by default, Ireland);

(g) Annex I.A and I.B of the EU SCCs are completed with the information in Annex 1 of this DPA; Annex II with the measures in Annex 2; Annex III with the Sub-processors in Annex 3; and the competent supervisory authority (Annex I.C) is determined under Clause 13 of the EU SCCs (defaulting to the Irish Data Protection Commission where the exporter is outside the EEA).

12.2 The official EU SCCs to be appended are available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

13.  United Kingdom (UK GDPR)

13.1 Where the UK GDPR applies, the EU SCCs (completed as in clause 12) apply as modified by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the corresponding information from the EU SCCs and Annexes 1–3; in Table 4, both “Importer” and “Exporter” may end the Addendum as set out in it; the start date is the effective date of the Agreement.

13.2 The UK Addendum / International Data Transfer Agreement and guidance are available from the ICO at:  https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/

14.  Switzerland (Swiss DPA)

14.1 Where the Swiss DPA applies, the EU SCCs apply with the following modifications: references to the GDPR are read as references to the Swiss DPA; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term “Member State” shall not be read to deprive Data Subjects in Switzerland of the right to sue in their place of habitual residence; and the EU SCCs are governed by Swiss law for Swiss transfers.

15.  Singapore (PDPA)

15.1 Where the Singapore PDPA applies, XSolutions agrees to be bound by legally enforceable obligations to provide a standard of protection for the transferred Personal Data comparable to that under the PDPA, in satisfaction of the Transfer Limitation Obligation (section 26 PDPA and regulation 10 of the Personal Data Protection Regulations 2021). The obligations in Part A of this DPA constitute those obligations.

16. United States and other third-country Controllers

16.1 Where the Tenant is established outside the EEA/UK (for example, in the United States) but is subject to the GDPR/UK GDPR under Article 3(2) in respect of Data Subjects in the EEA/UK, or otherwise transfers EEA/UK-origin Personal Data to XSolutions, the relevant Standard Contractual Clauses in clauses 12–14 apply to that Restricted Transfer and the protections afforded to the Personal Data travel with it.

16.2 Where US state privacy laws apply (for example, the CCPA/CPRA and comparable state laws), XSolutions acts as a “service provider” / “processor” and shall: (a) process the Personal Data only to provide the Services and on the Tenant's documented instructions; (b) not sell or share the Personal Data, and not retain, use or disclose it for any purpose other than the Services or as permitted by law; and (c) not combine it with data from other sources except as permitted by those laws. XSolutions certifies that it understands and will comply with these restrictions.

17.  Order of precedence and general

17.1 In the event of any conflict: the Standard Contractual Clauses prevail over the remainder of this DPA in respect of Restricted Transfers; this DPA prevails over the rest of the Agreement on matters of data protection; and the Agreement governs all other matters, including liability and limitations of liability, which apply to this DPA.

17.2 Except for the Standard Contractual Clauses and Part B region-specific terms (which are governed as stated in them), this DPA is governed by the laws of the State of New York, USA, without regard to conflict-of-laws rules. If any provision is held invalid, the remainder continues in effect.

17.3  XSolutions may update this DPA to reflect changes in Applicable Data Protection Law or its Sub-processors or security measures, provided such updates do not materially reduce the protections for Data Subjects.

18.  How to execute

18.1 This DPA is executed by XSolutions in the Execution block below and forms part of the Agreement. A Tenant accepts it (a) by entering into or continuing to use the IP under the Agreement, or (b) by counter-signing the Execution block (Controller) and returning the signed DPA to XSolutions at Jimperato-sr@xsolutions.com. Where the Agreement has been accepted, no separate Tenant signature is required for the DPA to be binding.

Execution

Signed by the duly authorized representatives of the parties. XSolutions executes this DPA below for the posted version; the Tenant may counter-sign where it wishes to hold a signed copy.

A.  List of parties

Data exporter (Tenant / Controller) — to be completed by the Tenant:

B.  Description of processing / transfer

C.  Competent supervisory authority

Where the EU GDPR applies, the competent supervisory authority is determined under Clause 13 of the EU SCCs by reference to the data exporter's place of establishment (defaulting to the Irish Data Protection Commission where the exporter is outside the EEA). Where the UK GDPR applies, the competent authority is the UK Information Commissioner's Office (ICO). Where the Swiss DPA applies, it is the Swiss Federal Da_ta Protection and Information Commissioner.