Data Processing Agreement.

1. Parties, application and priority

This Data Processing Agreement (DPA) forms part of the agreement under which Amerged B.V., Op de Smelen 1, 5863 BN Blitterswijck, the Netherlands, Chamber of Commerce number 42154221, VAT number NL869953308B01 (Amerged), provides services to the customer identified in the applicable order or statement of work (Customer). It applies when Amerged processes personal data on the Customer's behalf in providing those services. The order, statement of work and Master Service Agreement are together the Agreement.

The DPA becomes binding when incorporated into an Agreement accepted by both parties. Publication or downloading alone does not execute an agreement. This version applies to Agreements that incorporate it; an update on the website does not retrospectively amend an existing Agreement.

The DPA and its annexes prevail over conflicting provisions of the Agreement concerning processing of Customer Personal Data. Applicable, validly concluded standard contractual clauses prevail over this DPA to the extent of a conflict. Mandatory data protection law remains unaffected. The Dutch text is authoritative; English and German versions are translations for convenience. This language rule does not alter an official SCC text or a data subject's mandatory rights.

2. Definitions and allocation of roles

GDPR means Regulation (EU) 2016/679. Applicable Data Protection Law means the GDPR and applicable national legislation implementing or supplementing it. Personal data, processing, controller, processor, data subject and personal data breach have their GDPR meanings. Customer Personal Data means personal data processed by Amerged on the Customer's behalf under the Agreement. A Subprocessor is another processor engaged by Amerged for that processing.

The Customer acts as controller and Amerged as processor. If the Customer acts as processor for another controller, Amerged acts as its subprocessor. The Customer shall have that controller's authority to appoint Amerged, issue instructions and approve further subprocessors. The same substantive protections apply in either arrangement. Actual responsibilities follow the parties' activities and applicable law, regardless of contractual labels.

This DPA does not govern personal data Amerged processes as an independent controller, such as necessary business contact, contract administration and statutory accounting data. Those activities are described in the Privacy Notice. A separate controller purpose does not permit Amerged to repurpose the Customer's workflow content.

3. Customer responsibilities and instructions

The Customer determines the purposes of processing, its lawful basis, required notices and the lawfulness of data supplied. It shall assess whether the services and agreed safeguards suit the intended processing, maintain appropriate account permissions, and provide information needed to execute lawful instructions. Customer responsibility does not release Amerged from its own obligations.

The Agreement, this DPA, the completed order and authorised service configurations constitute documented instructions. Additional instructions shall be submitted through the Customer's designated contractual contact in a durable written form. Amerged may verify the sender's authority. Instructions shall describe the intended operation sufficiently to permit secure implementation. A change affecting service scope, cost or technical feasibility shall be discussed and documented; this process shall not delay mandatory assistance or compliance.

Amerged shall process Customer Personal Data only on documented instructions, including instructions regarding transfers, unless Union or Member State law requires otherwise. In that case Amerged shall inform the Customer of the legal requirement before processing unless that law prohibits notification on important public-interest grounds. Amerged shall promptly inform the Customer if it considers an instruction to infringe Applicable Data Protection Law and may suspend the affected operation pending clarification. It shall not independently select a new purpose or sell Customer Personal Data.

4. Confidentiality, personnel and security

Amerged shall ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty. Access shall be limited to personnel whose duties require it and shall be withdrawn when no longer needed. Personnel shall receive proportionate instructions on secure handling and incident escalation.

Amerged shall implement and maintain appropriate technical and organisational measures taking account of the state of the art, implementation cost, processing context and risks to individuals. The contractual minimum measures are set out in the Technical and Organisational Measures, which form Annex II to this DPA. They include access management, transport protection, protection of stored data, operational security, recovery and incident management.

Amerged may improve or replace individual measures without reducing the overall protection promised for the services. Material changes affecting agreed safeguards shall be documented and communicated. Additional safeguards required for an unusual or high-risk use case shall be agreed before that processing begins. No certification, independent audit result or fixed availability level is represented by this DPA.

5. Subprocessors

The Customer gives general written authorisation for Amerged to engage Subprocessors in accordance with this section. The applicable initial providers, functions and location information are described in the Subprocessor List, forming Annex III. A provider listed as optional is authorised for a particular Customer only when the associated service is expressly ordered.

Amerged shall conduct a proportionate assessment before appointment and conclude a written contract imposing data protection obligations substantively equivalent to those applicable to the entrusted processing. It shall remain responsible to the Customer for the Subprocessor's performance of those obligations. Amerged shall maintain information about the processing chain and make information necessary for the Customer's compliance assessment available on request.

Amerged shall notify the designated contractual contact at least 30 days before a new or replacement Subprocessor begins processing Customer Personal Data, explaining its function, processing location and relevant transfer safeguards. Updating a public list alone does not replace that notice. The Customer may object within that period on reasoned data protection grounds. The parties shall work in good faith to resolve the concern, including an alternative provider, configuration or exclusion of the affected function.

Amerged shall not start the disputed processing while a timely, reasoned objection remains unresolved. If no reasonable solution is available before the planned change, either party may terminate the affected service on written notice without an early termination charge for that service. Amerged shall refund prepaid fees for its unused period and support return or deletion under section 10. Unaffected services continue. A Customer-selected independent integration does not become Amerged's Subprocessor merely because the service connects to it; Amerged remains responsible for providers it actually appoints.

6. Locations and international transfers

The agreed baseline for core customer application hosting is Contabo infrastructure in Munich, Germany. A customer's order or documented infrastructure schedule shall identify the deployment and any separately agreed location. Backup and support arrangements shall be included in the location assessment. A different core hosting location requires prior documented agreement; the provider's registered office alone is not proof of a server location.

Cloudflare provides internet-facing protection and may also deliver the public website through its edge network. Depending on the service configuration, it processes connection information, security events and traffic passing through the protected endpoint. Its global operation can involve processing outside the European Economic Area (EEA); this DPA does not promise EU-only Cloudflare processing.

For expressly ordered AI services, Amerged shall use AI Act-compliant models through Orq.ai on EU-hosted infrastructure, with model inference performed in the EU. This is a binding selection and deployment commitment for the models approved for that service: Amerged shall verify the requirements of Regulation (EU) 2024/1689 that apply to the model, its provider, Amerged's role and the agreed use case. Before activation, Amerged shall document the model providers, evidence supporting that assessment, EU endpoints and EU fallback routes. Any additional use-case requirements shall be agreed and met before the relevant processing begins. An EU gateway alone is insufficient. Departure from the agreed EU inference arrangement requires an express amendment to the applicable order accepted by both parties; an ordinary processing instruction alone is insufficient. Separately authorised support or telemetry transfers remain subject to the applicable transfer safeguards and do not authorise inference outside the EU. The commitment does not certify every model offered in Orq.ai's catalogue.

Amerged shall not make a transfer requiring Chapter V GDPR safeguards without a valid legal mechanism and any necessary supplementary measures. Where appropriate it shall rely on an applicable adequacy decision, including a recipient's valid and relevant framework participation, or validly concluded SCCs. SCC modules and annexes must match the real exporter, importer and roles; processor-to-subprocessor transfers normally require Module 3 where those SCCs apply. Amerged shall assess the transfer circumstances and reassess material changes. If adequate protection cannot be maintained, the affected transfer shall be suspended or replaced. The SCC and Transfer Framework explains the applicable documentation; linking to it does not deem every possible transfer signed or authorised.

7. Assistance and data subject requests

Taking account of the processing and information available, Amerged shall assist the Customer with requests to exercise GDPR rights, security obligations, breach assessment and notifications, data protection impact assessments and prior consultation with a supervisory authority. Assistance shall include relevant processing information and practicable technical or organisational support.

If Amerged receives a request concerning Customer Personal Data, it shall promptly forward it to the designated contractual contact. It shall not substantively respond, disclose data or determine the outcome without instructions, unless legally required. The Customer verifies identity and determines the lawful response. Amerged may acknowledge receipt and explain its processor role.

Ordinary assistance reasonably inherent in operating the services is included. Substantial additional work may be charged at agreed reasonable rates after describing its scope and cost. Charges, advance payment or a commercial dispute shall not obstruct mandatory assistance, regulatory cooperation or time-sensitive protection of individuals. Amerged shall bear assistance costs attributable to its own breach of this DPA.

8. Personal data breaches

Amerged shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Its operational target is an initial notification within 48 hours of awareness. That target is not a waiting period, an extension of the legal standard or a replacement for the Customer's own notification deadlines.

The notice shall, as information becomes available, describe the nature of the breach, affected data and data subjects, approximate numbers, likely consequences, mitigation measures and a contact for follow-up. Amerged may provide information in phases without undue delay and shall not postpone the initial notification merely because an investigation is incomplete.

Amerged shall promptly contain and investigate the incident, preserve relevant evidence, document its assessment and cooperate with reasonable response instructions. The Customer determines notifications to authorities and individuals unless law places a direct duty on Amerged. Neither an initial notice nor assistance is by itself an admission of fault or liability.

9. Accountability, information and audits

Amerged shall keep records required of it and make information necessary to demonstrate compliance with this DPA and Article 28 GDPR available to the Customer. The parties shall first use proportionate documentation, questionnaires and remote review where those methods are sufficient.

The Customer or an independent auditor it appoints may conduct an audit, including inspection, where needed to assess compliance. Routine audits are normally limited to once in any 12 months on reasonable prior notice during business hours. This limit does not apply to a substantiated compliance concern, relevant personal data breach, a material change requiring verification, a supervisory authority's request or another mandatory legal requirement.

The parties shall agree reasonable confidentiality and security arrangements, protect other customers' data and avoid unnecessary disruption. These arrangements shall not prevent an effective audit or access required by law. Amerged shall cooperate, address substantiated deficiencies without undue delay and provide a proportionate remediation account. Each party normally bears its own routine audit costs; reasonable extraordinary assistance costs may be agreed, but fees shall not defeat statutory audit rights. Relevant supervisory authorities retain their full powers.

10. Return, retention and deletion

The Customer may instruct return or deletion of Customer Personal Data at the end of the services and may change that choice before completion. Unless it instructs earlier deletion, Amerged shall provide a 30-day export window after termination or expiry. Export shall use a reasonably usable, commonly supported format appropriate to the service. Custom migration work may be separately agreed.

Following that window, Amerged shall delete Customer Personal Data from active systems within the next 30 days, no later than 60 days after the services end. Residual backup copies shall expire within 90 days after active deletion and in any event within 150 days after the services end. Until expiry they shall be access-restricted, excluded from ordinary use and processed only for recovery or security. If restored, the applicable deletion instructions shall be reapplied.

Security and operational logs normally have a maximum retention period of 180 days from creation. Where logs contain Customer Personal Data processed on behalf of the Customer, the earlier applicable termination-deletion deadline above prevails. The parties may agree shorter service-specific periods. Amerged shall communicate deletion instructions to relevant Subprocessors and confirm completion on reasonable request.

Where Union or Member State law requires continued storage, Amerged shall identify the basis and duration where legally permitted, isolate the necessary data, restrict its processing to that legal purpose and delete it when the obligation ends. A legal dispute is not a blanket exception for retaining service content. Amerged may retain strictly necessary records for its own legal claims only under a separate lawful controller basis, with restricted access and proportionate retention; this does not override processor deletion duties.

11. Duration, liability and contact

This DPA remains effective while Amerged processes Customer Personal Data, including during permitted return, deletion and backup expiry. If Amerged cannot comply, it shall inform the Customer promptly, take remedial steps and suspend affected processing where necessary. Material breaches are subject to the Agreement's remedies and mandatory law.

The Agreement governs contractual liability to the extent law permits. Nothing limits data subjects' statutory rights, the parties' responsibilities under Article 82 GDPR or the powers of a supervisory authority. Amendments shall be documented and shall not lower mandatory protection. Questions, instructions and notices shall use the parties' designated contractual contacts. Customers may also contact Amerged through the contact form; Amerged shall verify authority where necessary and arrange a secure channel for sensitive details. Written correspondence may alternatively be addressed to Amerged's registered address in section 1, marked “Data protection”.

12. Annex I — Processing description

The order shall narrow or supplement this description where the actual project requires it. It may not silently expand sensitive processing or introduce an unapproved transfer. Annex II: TOMs and Annex III: Subprocessors form integral parts of this DPA.