Data Processing Agreement

1. Subject Matter and Nature of this DPA

1. 1.1.The Controller entrusts the Processor with the processing of, and the Processor accepts for processing, the personal data processed in connection with the Controller’s use of the Service, within the scope and for the purpose set out in Annex 1 to this DPA.
2. 1.2.The Processor provides the Service as a cloud infrastructure provider. The Processor has no visibility into the content of the data that the Controller enters into the Controller’s Sandbox environment, unless access to such data is necessary to provide technical support, to remedy a failure of the Service, or to carry out an express, documented instruction from the Controller.
3. 1.3.The Controller is solely responsible for the lawfulness of entering personal data into the Sandbox environment, including for the existence of a legal basis for the processing and for fulfilling the information obligations toward data subjects.
4. 1.4.In accordance with Section 8.6(a) of the Terms, the Controller must not submit personal data, including special categories of personal data and personal data relating to criminal convictions and offenses, through the AI features of the Service, unless the Processor has expressly permitted such processing and appropriate legal bases and safeguards are in place. Any processing of personal data carried out in breach of this prohibition takes place at the Controller’s sole responsibility and does not release the Processor from its obligations under Sections 3, 8, and 9.4 of this DPA.
5. 1.5.In the event of a conflict between the provisions of this DPA and the provisions of the Terms with respect to the processing of personal data, the provisions of this DPA will prevail.

2. Obligations of the Parties

1. 2.1.The Processor will process the entrusted personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organization, unless it is required to process the data by European Union or Member State law to which the Processor is subject. Documented instructions include, in particular, the provisions of the Terms and the actions taken and settings configured by the Controller within the Service, as well as separate instructions given to the Processor in documentary form. In the case referred to in the first sentence, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
2. 2.2.The Processor will immediately inform the Controller if, in the Processor’s opinion, an instruction given by the Controller infringes the GDPR or other applicable personal data protection provisions.
3. 2.3.The Processor will process the entrusted personal data only for the purpose or purposes of the processing set out in this DPA and its Annexes, unless it receives further instructions from the Controller. The Processor will not use the entrusted personal data for its own purposes, including for training, validating, or testing artificial intelligence models.

3. Security of Processing

1. 3.1.To ensure the security of personal data, the Processor will implement the technical and organizational measures set out in Annex 2 to this DPA, considering the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to the rights and freedoms of natural persons.
2. 3.2.The Processor will authorize its employees and contractors to process personal data only to the extent necessary for the performance of their duties related to the provision of the Service and will ensure that persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Cooperation of the Parties; Audit of the Processor

1. 4.1.The Processor will deal promptly and adequately with inquiries from the Controller about the processing of personal data in accordance with this DPA.
2. 4.2.The Processor will make available to the Controller the information necessary to demonstrate compliance with the obligations set out in this DPA and stemming directly from the GDPR, to the extent appropriate to the model under which the Service is provided as a self-service cloud service. At the Controller’s request, the Processor will allow for and contribute to audits, including inspections, of the processing activities covered by this DPA, conducted by the Controller or an auditor mandated by the Controller, to the extent justified by the nature of the Service and without compromising the security or confidentiality of the data of other users of the Service.
3. 4.3.The audits referred to in Section 4.2 will be carried out at reasonable intervals or where there are indications that the processing does not comply with the GDPR or this DPA, upon prior notice to the Processor in documentary form, given at least 7 business days in advance.
4. 4.4.If an audit reveals infringements of the GDPR or breaches of material provisions of this DPA, the Controller has the rights set out in Section 9 of this DPA.

5. Sub-processing

1. 5.1.The Processor is entitled to engage other processors (sub-processors) on the basis of the Controller’s general written authorization, granted upon the conclusion of this DPA. The current list of sub-processors is set out in Annex 3 to this DPA and in the Privacy Policy of the Service available at openmercatocloud.com/privacy.
2. 5.2.The Processor will inform the Controller of intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object to such changes within 7 days of being informed. If, within 14 days of the objection being raised, the Parties do not agree on how to accommodate it, the Controller may terminate this DPA and the agreement for the provision of the Service with immediate effect.
3. 5.3.The Processor will engage a sub-processor only on the basis of a contract that imposes on the sub-processor personal data protection obligations that are at least the same as those imposed on the Processor by this DPA and will ensure that the sub-processor complies with those obligations.
4. 5.4.At the Controller’s justified request, the Processor will provide information on the scope of the processing entrusted to a given sub-processor, subject to the protection of the Processor’s trade secrets and of the personal data of other users of the Service.
5. 5.5.The Processor remains fully responsible to the Controller for the performance of the sub-processor’s obligations in accordance with the sub-processor’s contract with the Processor. The Processor will notify the Controller of any material failure by a sub-processor to fulfill its obligations concerning the protection of personal data.

6. International Data Transfers

1. 6.1.Any transfer of personal data by the Processor to a third country or an international organization will take place only in connection with the Processor’s use of the sub-processors listed in Annex 3, in particular in connection with the AI features of the Service and the infrastructure used to provide the Service, or in order to fulfill a specific requirement under European Union or Member State law to which the Processor is subject.
2. 6.2.Any transfer referred to in Section 6.1 will take place in compliance with Chapter V of the GDPR, in particular on the basis of a European Commission decision finding an adequate level of protection, including Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework (with respect to sub-processors certified under that framework), or on the basis of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Three: processor to processor), or on the basis of another mechanism provided for in the GDPR.
3. 6.3.At the Controller’s request, the Processor will provide the Controller with information on the transfer mechanism applied to each of the sub-processors listed in Annex 3.

7. Data Subject Rights

1. 7.1.The Processor will promptly notify the Controller of any request received directly from a data subject concerning personal data processed within the Service. The Processor will not respond to such a request itself unless the Controller has given its prior documented authorization.
2. 7.2.Considering the nature of the processing, the Processor will assist the Controller, by appropriate technical and organizational measures available within the Service, in fulfilling the Controller’s obligation to respond to data subjects’ requests to exercise their rights laid down in Chapter III of the GDPR.
3. 7.3.The Processor will assist the Controller in ensuring compliance with the following obligations, considering the nature of the processing and the information available to the Processor:

• the obligation to carry out a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
• the obligation to consult the supervisory authority prior to processing where a data protection impact assessment indicates a high risk that the Controller has not mitigated by appropriate measures;
• the obligation to ensure that personal data is accurate and up to date, by promptly informing the Controller if the Processor becomes aware that the data being processed is inaccurate or outdated;
• the obligations set out in Articles 32 to 34 of the GDPR.

8. Notification of Personal Data Breaches

1. 8.1.If a personal data breach concerning data processed within the Service is identified, the Processor will notify the Controller of the breach without undue delay after becoming aware of it, in accordance with Section 18.8 of the Terms. The notification will contain at least:

• a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
• the details of a contact point where more information about the breach can be obtained;
• a description of the likely consequences of the breach and of the measures taken or proposed by the Processor to address the breach, including to mitigate its possible adverse effects.

1. 8.2.Where it is not possible to provide all of the information referred to in Section 8.1 of this DPA at the same time, the initial notification will contain the information then available, and the remaining information will be provided without undue delay once it has been obtained.

9. Breach of this DPA

1. 9.1.If the Processor breaches its obligations under this DPA, the Controller may instruct the Processor to suspend the processing of personal data until compliance with this DPA is ensured. The Processor will promptly inform the Controller if, for any reason, it is unable to comply with this DPA.
2. 9.2.The Controller is entitled to terminate this DPA with immediate effect if:

• compliance with this DPA is not restored within the time limit set by the Controller after the processing has been suspended in accordance with Section 9.1, and in any event within one month of the date of suspension;
• the Processor is in substantial or persistent breach of this DPA or of its obligations under the GDPR;
• an audit carried out in accordance with Section 4 has revealed an infringement of the GDPR by the Processor.

1. 9.3.The Processor has the right to terminate this DPA if, after the Processor has informed the Controller that the Controller’s instruction infringes applicable personal data protection provisions, the Controller insists on compliance with that instruction.
2. 9.4.After termination of this DPA or once use of the Service has ended, the Processor will, at the choice of the Controller and in accordance with the rules set out in the Terms, either delete all personal data processed on behalf of the Controller and certify that it has done so, or return that data to the Controller and delete existing copies, unless European Union or Member State law requires storage of that data. The Processor will continue to comply with this DPA until the data is deleted or returned.

10. Contact Details of the Parties

All communications relating to the performance of this DPA must be directed to the following persons or contact points:

• Controller: the email address assigned to the Controller’s account in the Service, as provided by the Controller upon registration; the Processor will send notifications concerning the protection of personal data, including breach notifications, to that address, unless the Controller provides the Processor with a separate contact point for that purpose;
• Processor: info@openmercato.com. Until a data protection officer has been designated and the designation has been notified, this contact point does not include the officer’s details.

Annexes:

• Description of the processing;
• Description of the technical and organizational measures to ensure the security of the data;
• List of sub-processors.

Annex 1: Description of the Processing

1. 1.Categories of data subjects whose personal data is processed: individuals whose data the Controller enters into its Sandbox environment in connection with its use of the Service (in particular, these may be the Controller’s customers, users, employees, or contractors, as well as other individuals whose data the Controller processes in the course of its own operations); these categories are determined solely by the Controller and depend on how the Controller uses the Service.
2. 2.Categories of personal data processed (ordinary data): dependent solely on the content that the Controller enters into the Sandbox environment (e.g., data contained in source code, test data, or configurations); the Processor has no influence over the scope of that data and does not verify its content.
3. 3.Special categories of personal data and personal data relating to criminal convictions and offenses that are processed: as a rule, not applicable; submitting such data to the AI features of the Service is prohibited under Section 8.6a of the Terms and Section 1.4 of this DPA, unless the Processor has expressly permitted such processing.
4. 4.Nature of the processing: storage, hosting, and provision of cloud infrastructure (a development environment with AI features), including processing using artificial intelligence models through the sub-processors listed in Annex 3, to the extent that the Controller uses the AI features of the Service.
5. 5.Purposes for which the personal data is processed on behalf of the Controller: enabling the Controller to develop applications independently in the cloud Sandbox environment, including with the use of AI features, in accordance with the Terms.
6. 6.Duration of the processing: the period during which the Controller uses the Service (the term of the active Sandbox subscription); once that period ends, the data is deleted or returned in accordance with Section 9.4 of this DPA, with residual data in backups being deleted in the ordinary overwrite cycle, as a rule within 7 days after use of the Service ends, in accordance with Section 12.5 of the Terms.

Annex 2: Technical and Organizational Measures

• user data in the active Sandbox environment is stored within the European Economic Area, using infrastructure provided by Hetzner Online GmbH, AWS EMEA SARL (branch in Poland), and Daytona Platforms Inc. (in accordance with Section 18.3 of the Terms), subject to transfers of data to third countries on the terms set out in Section 6 of this DPA;
• data transmitted between the Controller and the Service and between the Processor and sub-processors is encrypted using the TLS protocol, version 1.2 or higher; the Controller's data at rest, including in backups, is encrypted;
• access to an account in the Service requires authentication with a username and password or sign-in through an external identity provider (Google, GitHub); passwords are stored only as cryptographic hashes generated using the bcrypt(12) algorithm;
• user sessions are managed using JWT tokens with a limited validity period (access token: 15 minutes, refresh token: 7 days), stored in a manner that limits the risk of their being hijacked (in cookies with the HttpOnly, Secure, and SameSite=Lax attributes);
• access by the Processor's employees and contractors to the Controller's data is granted only in the cases referred to in Section 1.2 of this DPA, on a least-privilege basis, requires multi-factor authentication, is logged, and is revoked promptly once it is no longer needed or once the working relationship with the person concerned has ended;
• requests sent to the Service and failed authentication attempts are logged, and the logs are retained for 15 days in a separate logging system with access restricted to the Processor's authorized personnel; the Processor monitors the availability and operation of the Service infrastructure;
• data backups are made in the Amazon S3 service on Amazon AWS infrastructure within the European Economic Area and are deleted in the cycle specified in item (6) of Annex 1; the Processor ensures the ability to restore the availability of the data in a timely manner in the event of a physical or technical incident;
• the Sandbox environments of individual users of the Service are separated from one another by the mechanisms of the Daytona service (the Containers or Linux VM isolation levels; https://www.daytona.io/docs/en/isolation/) and have no access to one another to any extent
• the Processor regularly tests, assesses, and evaluates the effectiveness of the measures applied, including through penetration tests or source code analyses using tools such as SonarQube and AI models, carried out at least once a year; security certifications or audits of the Processor and of the sub-processors indicated in the Terms (AWS, Daytona, Hetzner) and the others described in the Terms and in Annex 3;
• the Processor applies a security incident handling procedure that enables personal data breaches to be detected and notified to the Controller in accordance with Section 8 of this DPA;
• the Processor ensures that persons authorized to process personal data within the Service have committed themselves to confidentiality, in accordance with Section 3.2 of this DPA.

The Processor confirms that the sub-processors listed in Annex 3 apply technical and organizational measures appropriate to the risk associated with the processing, to the extent provided for in their contracts with the Processor.

Annex 3: List of Sub-processors