Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (DPA) forms part of the Master Services Terms between the Customer (controller) and the Provider (processor), both named in the Order Form. It applies to personal data the Provider processes on the Customer’s behalf while testing the Customer’s apps (Customer Personal Data). The Provider’s own processing of the Customer’s contacts and account data is described in the Privacy Policy.

2. Instructions

The Provider processes Customer Personal Data only on the Customer’s documented instructions: the Master Services Terms, the Order Form, the test plan and written requests in the project chat. It tells the Customer if an instruction appears to infringe data protection law.

3. Confidentiality and security

Everyone who processes Customer Personal Data is bound by confidentiality. The Provider applies the measures in Annex II and keeps them at least at that level.

4. Subprocessors

The Customer gives general authorisation for the subprocessors in Annex III. The Provider e-mails the Customer at least 10 business days before adding or replacing one. Within that time the Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected service and receive a refund of prepaid fees for the unused period. Subprocessors are bound by duties no less protective than this DPA, and the Provider remains responsible for them.

5. Assistance, breaches and audits

As far as reasonably possible, the Provider helps the Customer to respond to data subjects’ requests, to carry out data protection impact assessments and to meet its security obligations.

The Provider notifies the Customer without undue delay, and no later than 48 hours after becoming aware of it, of a personal data breach affecting Customer Personal Data, with the information then available.

Once a year, or after a breach, the Customer may ask for a completed security questionnaire and evidence of the measures. Audits on site are agreed in writing in advance and carried out at the Customer’s cost.

6. Deletion and return

Test access is deleted within 14 days after the work ends. Reports and their screenshots stay in the Customer’s project until the Customer deletes the project or asks for their deletion. Other Customer Personal Data is deleted or returned, at the Customer’s choice, when the services end, unless the law requires it to be kept.

7. International transfers

The Provider and its team work from Ukraine, which has no EU adequacy decision; viewing data located in the EU from Ukraine is also a transfer. For transfers of personal data subject to the EU GDPR, the parties incorporate by reference the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914: Module 2 (controller to processor) between the Customer and the Provider, and Module 3 (processor to processor) where the Provider uses a subprocessor outside the EEA. Clause 7 (docking) applies; under Clause 9, option 2 applies with 10 business days’ notice; the optional wording in Clause 11 does not apply; under Clauses 17 and 18, the law and the courts of Ireland apply. Annexes I to III of this DPA complete the Clauses.

For personal data subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies. The Provider has assessed the risks of the transfers and applies the supplementary measures in Annex II.

8. Precedence and term

This DPA lasts as long as the Provider processes Customer Personal Data. If it conflicts with the Master Services Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. This edition applies from 24 October 2026.

Annex I. Details of processing

Data subjects: the Customer’s staff who use the project; users of the Customer’s test accounts; the Customer’s end users only where their data is visible in the environment the Customer gives access to.

Categories of data: logins of test accounts; names and e-mails of test accounts and of the Customer’s staff; data shown on screens during testing; screenshots and logs in reports. Special categories of data are not intended; the Customer should give access to test environments with synthetic or masked data.

Nature and purpose: manual and automated testing of the Customer’s apps for bugs and vulnerabilities, reports, retests and the letter for security questionnaires. Frequency: continuous during the subscription or order. Duration: the term of the services plus the retention described in section 6.

Annex II. Technical and organisational measures

Test logins are stored encrypted, shown to team members only when needed, and every view is logged; they are never sent in the chat or by e-mail.

All connections use TLS. Team members use individual accounts with multi-factor authentication and encrypted computers, and receive only the access the work needs; access ends when a person leaves the project.

Testing uses separate test accounts and, by default, staging environments. Production is tested only with dedicated accounts, without bulk actions, data exports or denial-of-service techniques.

Screenshots and reports avoid real personal data where possible; evidence is limited to what is needed to reproduce a finding. Notifications to the team’s messenger carry no Customer Personal Data.

AI tools are used only under terms that exclude training on the Customer’s data, and never receive passwords or keys.

Every team member signs a confidentiality agreement. Incidents are handled under a written procedure, with notice to the Customer within 48 hours. Backups are encrypted; the platform is kept up to date and its own security is tested.

Annex III. Subprocessors

Contabo — server hosting of the piperlink platform and its database.

Cloudflare, Inc. — network protection and delivery of piperlink.com.

WayForPay — card payments; receives payment data only, never data from testing.

Google — sign-in with Google, only for people who choose it.

Contracted specialists of the Provider in Ukraine, bound by confidentiality — testing, fixing and setup work under the Provider’s instructions.