Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") is entered into between Performalise FZ LLC ("Processor") and the Customer ("Controller") as identified in the applicable Order Form or Terms of Service.

This DPA forms part of, and is incorporated by reference into, the Terms of Service between the parties. In the event of any conflict between this DPA and the Terms of Service in respect of data protection matters, this DPA shall prevail.

This DPA is effective from the date the Customer accepts the Terms of Service and continues for the duration of the subscription.

Performalise FZ LLC is committed to compliance with UK GDPR and EU GDPR in respect of personal data processed on behalf of its customers. This DPA meets the requirements of GDPR Article 28. If you require a countersigned copy of this DPA, please email [email protected].

2. Definitions

Capitalised terms used but not defined in this DPA have the meanings given in the Terms of Service and Privacy Policy. In addition:

3. Roles of the parties

3.1 The parties acknowledge and agree that in relation to the processing of Personal Data under or in connection with the Services:

• The Customer is the Controller — it determines the purposes for which and the manner in which Personal Data is processed;
• Performalise FZ LLC is the Processor — it processes Personal Data solely on behalf of and under the documented instructions of the Controller.

3.2 The Controller warrants that it has a lawful basis for processing Personal Data and has obtained all necessary consents and complied with all applicable notice requirements to enable the lawful transfer of Personal Data to Performalise FZ LLC.

3.3 Performalise FZ LLC does not determine the purposes for which Customer Personal Data is processed. Any processing carried out outside the Customer's documented instructions would constitute independent processing for which Performalise FZ LLC assumes Controller responsibility.

4. Processor obligations

In relation to the processing of Personal Data, Performalise FZ LLC shall:

4.1 Act only on documented instructions of the Controller, unless required to do so by applicable law (in which case, Performalise FZ LLC shall inform the Controller before processing, unless prohibited by law);

4.2 Ensure confidentiality — ensure that all persons authorised to process Personal Data are subject to appropriate confidentiality obligations;

4.3 Implement security measures — implement and maintain appropriate technical and organisational measures to protect Personal Data in accordance with GDPR Article 32 (see Section 8 and the Data Security page);

4.4 Notify of conflicts — promptly inform the Controller if any instruction infringes applicable Data Protection Legislation in Performalise FZ LLC's reasonable opinion;

4.5 Assist with compliance — assist the Controller in meeting its obligations under Data Protection Legislation, including with respect to: Data Subject rights requests; security; breach notifications; Data Protection Impact Assessments (DPIAs); and prior consultation with supervisory authorities, at the Controller's reasonable cost;

4.6 Maintain records — maintain complete and accurate records of processing activities as required by GDPR Article 30, and make these available to the Controller on reasonable written request;

4.7 International transfers — not transfer Personal Data outside the UK or EEA without the Controller's prior written consent and appropriate safeguards in place (see Section 6).

5. Sub-processors

5.1 The Controller provides general written authorisation for Performalise FZ LLC to appoint the Sub-processors listed in Schedule 2, subject to the requirements of this section.

5.2 Performalise FZ LLC shall:

• Maintain an up-to-date list of approved Sub-processors (see Schedule 2);
• Give the Controller at least 30 days' prior written notice of any intended addition or replacement of Sub-processors;
• Impose data protection obligations on Sub-processors that are at least equivalent to those in this DPA;
• Remain fully liable to the Controller for all acts and omissions of its Sub-processors as if they were Performalise FZ LLC's own acts and omissions.

5.3 If the Controller objects to a new Sub-processor on reasonable data protection grounds within the 30-day notice period, the parties shall discuss in good faith. If no agreement is reached within a further 30 days, the Controller may terminate the Services without penalty for the unexpired subscription period on written notice.

6. International transfers

6.1 Where Performalise FZ LLC transfers Personal Data to a country outside the UK or EEA that does not benefit from an adequacy decision, it shall ensure that appropriate safeguards are in place, specifically:

• UK transfers: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (UK SCCs Addendum);
• EEA transfers: the EU Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914/EU), Module 2 (Controller to Processor);
• Supplementary measures: TLS 1.3 encryption in transit and AES-256 encryption at rest for all transferred data.

6.2 Our primary data hosting is on AWS infrastructure (US regions). AWS participates in the EU-US Data Privacy Framework (DPF). Applicable SCCs or IDTA are in place with AWS as required.

6.3 Copies of applicable transfer mechanisms are available on request from [email protected].

7. Data subject rights

7.1 Taking into account the nature of the processing, Performalise FZ LLC shall provide reasonable assistance to the Controller in responding to Data Subject rights requests under Data Protection Legislation, including requests relating to:

• Right of access (Subject Access Requests);
• Right to rectification of inaccurate Personal Data;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to data portability;
• Right to object to processing.

7.2 If Performalise FZ LLC receives a rights request directly from a Data Subject, it will promptly forward it to the Controller without responding independently, unless instructed or required by law to do so.

7.3 Assistance beyond standard platform functionality will be provided at the Controller's reasonable cost.

8. Security measures

In accordance with GDPR Article 32, Performalise FZ LLC implements and maintains the following technical and organisational measures. These are consistent with, and cross-reference, the Data Security Policy:

9. Breach notification

9.1 Performalise FZ LLC shall notify the Controller without undue delay, and in any event within 72 hours of confirming that a Personal Data Breach affecting Customer Data has occurred, by email to the Controller's designated contact address. Initial notification may be provided without complete details where these are not yet available; further information will be provided as it becomes known.

9.2 The notification shall include, to the extent known at the time:

• The nature of the Personal Data Breach, including categories and approximate numbers of Data Subjects and records affected;
• The name and contact details of the relevant data protection contact;
• The likely consequences of the Personal Data Breach;
• The measures taken or proposed to address the breach, including mitigation steps.

9.3 Performalise FZ LLC shall cooperate with the Controller and take commercially reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

9.4 The Controller is solely responsible for notifying the relevant supervisory authority (such as the ICO in the UK) and any affected Data Subjects as required by applicable Data Protection Legislation, using information provided by Performalise FZ LLC as above.

10. Audit rights

10.1 Performalise FZ LLC shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits or inspections conducted by the Controller or a mandated third-party auditor.

10.2 Any audit shall be subject to: (a) at least 30 days' prior written notice; (b) reasonable confidentiality obligations; (c) a maximum of one audit per calendar year unless a Personal Data Breach has occurred; and (d) costs beyond standard documentation being borne by the Controller.

10.3 Performalise FZ LLC may, at its discretion, provide third-party penetration test reports and security audit summaries as an alternative to a full on-site inspection, where these adequately demonstrate compliance with this DPA.

11. Retention & return of data

11.1 On termination or expiry of the subscription, Performalise FZ LLC shall, at the Controller's written request received within 30 days of termination, either:

• Return all Customer Data and Personal Data in a portable, structured format (CSV or JSON); or
• Securely delete and certify the deletion of all Customer Data and Personal Data.

11.2 If no written request is received within 30 days of termination, Performalise FZ LLC shall securely delete all Customer Data without further notice.

11.3 Performalise FZ LLC may retain Personal Data for longer where required by applicable law, in which case it will notify the Controller and ensure the data is not used for any other purpose.

12. Governing law

This DPA is governed by and construed in accordance with the laws of England and Wales. Each party irrevocably submits to the exclusive jurisdiction of the courts of England and Wales for the resolution of any dispute arising out of or in connection with this DPA, including non-contractual disputes.

Where this DPA operates alongside contracts governed by the laws of another jurisdiction, the data protection obligations in this DPA shall nonetheless apply as written, in compliance with applicable Data Protection Legislation.

Schedule 1: Processing details

Schedule 2: Approved sub-processors

The following Sub-processors are approved as at the Effective Date. Performalise FZ LLC will notify the Controller of any additions or replacements in accordance with Section 5.