Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement or other written agreement (the “Agreement”) entered into between Customer and Complydo Solutions GmbH (“ComplyDo”) (collectively referred to in this DPA as the “Parties” and each a “Party”). Capitalized terms not otherwise defined in this DPA have the meaning given to them in the Agreement.

1. Definitions

1.1. "Agreement" means the Master Services Agreement (including the Order Form) or any other agreement entered into between Customer and ComplyDo in which this DPA is incorporated by reference, as the same may be amended from time to time.

1.2. "Controller" has the meaning given to it in Art. 4(7) GDPR.

1.3. "Controller Data" means the Personal Data contained within Customer Data that is Processed by ComplyDo on behalf of Customer pursuant to the Agreement and this DPA.

1.4. "Customer Data" has the same meaning set forth in the Agreement.

1.5. "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Data.

1.6. "Data Protection Laws" means all data protection and privacy laws applicable to the respective Party in its role in the Processing of Personal Data under the Agreement, including without limitation the GDPR, the GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR") and the Data Protection Act 2018, and the Swiss Federal Act on Data Protection of 25 September 2020 and the Swiss Ordinance of 31 August 2022 on Data Protection, and any implementing, supplementing, or successor legislation thereto.

1.7. "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

1.8. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation).

1.9. "Personal Data" means any information relating to an identified or identifiable natural person within the meaning of Art. 4(1) GDPR.

1.10. "Processor" has the meaning given to it in Art. 4(8) GDPR.

1.11. "Processing" (including Process, Processed, and Processes) has the meaning given to it in Art. 4(2) GDPR.

1.12. "Standard Contractual Clauses" or "SCCs" means the standard data protection clauses adopted by the European Commission under Art. 46(2)(c) GDPR for the transfer of Personal Data to third countries that do not ensure an adequate level of protection, in the version currently in force (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), as amended, updated, or replaced from time to time.

1.13. "Sub-processor" means any Processor engaged by ComplyDo to Process Controller Data on behalf of Customer.

1.14. "Supervisory Authority" means an independent public authority established under Art. 51 GDPR.

1.15. "Technical and Organizational Measures" or "TOMs" means the security measures required under Art. 32 GDPR to ensure an appropriate level of protection of Personal Data.

2. Subject Matter and Scope

2.1. As part of the provision of the Tool and the Services under the Agreement, it is necessary for ComplyDo to Process Personal Data for which Customer acts as the Controller within the meaning of Data Protection Laws. This DPA specifies the data protection rights and obligations of the Parties in connection with the Processing of Controller Data for the performance of the Agreement.

2.2. Except as provided by this DPA, the Agreement remains unchanged and in full force and effect. This DPA shall replace and supersede any existing data processing addendum, attachment, exhibit, or standard contractual clauses that ComplyDo and Customer may have previously entered into in connection with the Services.

2.3. This DPA becomes effective from the Effective Date of the Agreement and remains in effect for as long as ComplyDo Processes Controller Data pursuant to the Agreement.

2.4. The details of the Processing, in particular the categories of Personal Data and the purposes for which Controller Data is Processed on behalf of Customer, are specified in Annex 1.

2.5. Annexes 1 to 3 are incorporated into and form part of this DPA.

3. Scope of Data Processing

3.1. ComplyDo shall Process Controller Data on behalf of and in accordance with the instructions of Customer within the meaning of Art. 28 GDPR. Customer shall remain the Controller within the meaning of Data Protection Laws.

3.2. ComplyDo shall not: (i) sell Controller Data or otherwise make Controller Data available to any third party for monetary or other valuable consideration; (ii) share Controller Data with any third party for cross-context behavioral advertising; (iii) retain, use, or disclose Controller Data for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by Data Protection Laws; or (iv) combine Controller Data with other Personal Data that ComplyDo receives from or on behalf of another controller or controllers, or collects from its own interaction with the Data Subject.

4. Instructions by the Controller

4.1. ComplyDo shall Process Controller Data only on documented instructions from Customer, unless required to do so by applicable law to which ComplyDo is subject. In this case, ComplyDo shall inform Customer of that legal requirement before Processing, unless the law prohibits this on important grounds of public interest.

4.2. Customer’s instructions are defined in this DPA and the Agreement. In addition, ComplyDo makes available to Customer configuration options within the ComplyDo platform through which Customer may customize the Processing of Controller Data within the scope of the platform’s standard operation. Use of these configuration options constitutes a documented instruction within the meaning of this DPA. Instructions going beyond the foregoing that require customization of ComplyDo’s standard service are only binding to the extent they have been agreed in writing and documented in the Agreement or a separate amendment.

4.3. ComplyDo shall immediately inform Customer if, in ComplyDo’s opinion, instructions given by Customer infringe applicable Data Protection Laws.

5. Responsibility of the Controller

5.1. As between the Parties, Customer is solely responsible for the lawfulness of the instructions issued and the lawfulness of the Processing of Controller Data. Should any third-party bring claims against ComplyDo in connection with the Processing of Controller Data under this DPA, Customer shall indemnify ComplyDo against such claims to the extent they are based on Customer’s breach of this DPA or applicable law.

5.2. Customer shall not instruct ComplyDo to Process Controller Data in violation of Data Protection Laws. ComplyDo shall have no obligation to assess the contents or accuracy of Controller Data.

5.3. Unless expressly agreed otherwise in the relevant Order Form, Customer shall not upload, transmit, or otherwise Process through the Tool any data subject to heightened legal protection, in particular data falling within Articles 9 or 10 GDPR or subject to a statutory professional secrecy obligation.

5.4. For the avoidance of doubt, where Customer uploads documents or other content containing Personal Data of third parties to the Tool, Customer shall remain solely responsible for ensuring compliance with its obligations under Data Protection Laws in relation to such data, including in particular the existence of a valid legal basis and the fulfilment of transparency obligations vis-à-vis the relevant Data Subjects.

6. Security of Processing

6.1. ComplyDo shall take appropriate Technical and Organizational Measures in accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing of Controller Data as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, to ensure a level of security for Controller Data appropriate to the risk.

6.2. The Parties agree that the Technical and Organizational Measures set out in Annex 3 ensure an appropriate level of protection for Controller Data at the time of conclusion of this DPA. ComplyDo shall be permitted to change or adapt Technical and Organizational Measures during the term of this DPA as long as such measures continue to meet the statutory requirements and do not reduce the overall level of data protection set out in Annex 3.

6.3. The high level of security is supported by ComplyDo’s ISO 27001 certification.

7. Requirements for Personnel

7.1. ComplyDo ensures that persons authorized to Process Controller Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.2. ComplyDo ensures that access to Controller Data is limited to those personnel who require such access for the performance of ComplyDo’s obligations under the Agreement.

8. Use of Sub-processors

8.1. Customer hereby grants ComplyDo general authorization to engage Sub-processors with regard to the Processing of Controller Data. The Sub-processors engaged at the time of the conclusion of this DPA are set out in Annex 2.

8.2. ComplyDo shall inform Customer of any intended changes regarding the addition or replacement of Sub-processors at least 14 days prior to the planned engagement of the new Sub-processor. Notification shall be made via email to the contact designated by Customer. Customer is entitled to object in writing to the intended change within 14 days of receipt of the notification, provided that the objection is based on specific data protection grounds. If no objection is raised within that period, the change shall be deemed approved.

8.3. In the event of a timely and duly reasoned objection, the Parties shall attempt to reach a mutually agreeable solution. If no agreement is reached within 14 days of receipt of the objection, either Party shall be entitled to terminate the Agreement and this DPA with a notice period of 30 days.

8.4. ComplyDo shall contractually impose on Sub-processors data protection obligations that correspond to the level of protection under this DPA (Art. 28(4) GDPR). Where a Sub-processor Processes Controller Data in a third country, ComplyDo shall ensure that an appropriate transfer mechanism ensuring an adequate level of protection within the meaning of Art. 44 et seq. GDPR is in place, such as by entering into Standard Contractual Clauses pursuant to Art. 46 GDPR in accordance with the applicable template of the European Commission. ComplyDo shall ensure that Sub-processors do not use Controller Data for the training, improvement, or development of their own or third-party machine learning models, unless expressly instructed by Customer.

8.5. ComplyDo shall remain responsible to Customer for the performance of the Sub-processor’s obligations in accordance with its contract with ComplyDo.

9. International Data Transfers

9.1. The Processing of Controller Data by ComplyDo shall, by default, take place within the European Union or a member state of the European Economic Area (EEA).

9.2. Any transfer of Controller Data by ComplyDo to a third country or international organization shall take place only on the basis of a documented instruction from Customer and in accordance with Art. 44 et seq. GDPR.

9.3. Where Controller Data is transferred to or Processed in a third country or international organization by ComplyDo or a Sub-processor, ComplyDo shall ensure that an appropriate transfer mechanism ensuring an adequate level of protection within the meaning of Art. 44 et seq. GDPR is in place.

9.4 Where ComplyDo or a Sub-processor receives a request from a governmental body for disclosure of Controller Data, ComplyDo shall (i) attempt to redirect the governmental body to request such data directly from Customer, (ii) promptly notify Customer of the request to the extent legally permitted, (iii) challenge the request where it reasonably appears to conflict with applicable Data Protection Laws, in particular Art. 48 GDPR, and (iv) disclose only the minimum amount of Controller Data strictly necessary if compelled to comply. ComplyDo may provide Customer's basic contact information to the governmental body for purposes of redirecting the request.

10. Data Subject Rights

10.1. Taking into account the nature of the Processing and the information available, ComplyDo shall assist Customer, by appropriate Technical and Organizational Measures to the extent reasonable, to comply with Customer’s obligation to respond to requests to exercise the rights of Data Subjects under the GDPR. For this purpose, ComplyDo shall make available to Customer functionalities within the ComplyDo platform that enable Customer to independently handle typical Data Subject requests.

10.2. Customer hereby instructs ComplyDo to implement requests from Data Subjects to exercise their rights regarding (a) the rectification of account or profile data and (b) the deactivation or deletion of the user account and the data exclusively associated with that user account independently and without prior consultation with Customer, where such requests are submitted directly to ComplyDo and the identity of the Data Subject has been verified by appropriate means (e.g., through the email address associated with the user account).

10.3. Where ComplyDo receives a request from a Data Subject to exercise the rights under the GDPR that is not handled by ComplyDo independently (in particular because it raises legal or factual questions or goes beyond the standard cases set out in Section 10.2), ComplyDo shall forward the request to Customer without undue delay. Upon Customer’s request, ComplyDo shall in such cases assist Customer by appropriate Technical and Organizational Measures, insofar as reasonably possible and necessary, in fulfilling Customer’s obligations.

10.4. Where a Data Subject request relates to Personal Data of a third party contained in documents, files, or other content uploaded by Customer, the following shall apply:

(a) Customer shall be responsible for identifying the relevant data records and for instructing ComplyDo on the measures to be taken (e.g., deletion, rectification, restriction of Processing);

(b) ComplyDo shall implement Customer's instructions pursuant to paragraph (a) without undue delay and to the extent technically feasible within the standard functionality of the Tool; and

(c) where the implementation of a Data Subject request requires measures beyond the standard functionality of the Tool, ComplyDo shall inform Customer thereof and the Parties shall agree on an appropriate course of action. ComplyDo shall be entitled to reasonable compensation for any additional effort incurred.

11. Notification and Support Obligations

11.1. In the event of a Data Breach affecting Controller Data, ComplyDo shall notify Customer thereof without undue delay after becoming aware of the breach. Such notification shall, where possible, be made within 48 hours of confirmation of the breach. The notification shall be made on the basis of the information available to ComplyDo at the time of the notification and shall contain, at a minimum: (i) a description of the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and data records concerned); and (ii) the measures taken or proposed to be taken to address the breach, including mitigating its possible adverse effects. To the extent that further relevant information becomes available, ComplyDo shall provide such information to Customer without undue delay.

11.2. Upon Customer’s request, ComplyDo shall, taking into account the nature of the Processing and the information available to ComplyDo, assist Customer in fulfilling any notification and communication obligations under the GDPR, insofar as such assistance is necessary and reasonable. The legal assessment as to whether and to what extent any notification or communication obligation exists shall remain the responsibility of Customer.

11.3. Upon Customer’s request, ComplyDo shall, taking into account the nature of the Processing and the information available to ComplyDo, assist Customer with any data protection impact assessments and prior consultations with Supervisory Authorities, insofar as such assistance is necessary and reasonable. To the extent that such assistance causes significant additional effort exceeding the assistance contractually owed, the Parties shall agree in advance on appropriate additional remuneration.

11.4. ComplyDo’s designated contact for data protection matters and breach notifications is: Moritz Moser, security@complydo.io.

12. Data Deletion

12.1. ComplyDo shall delete Controller Data no later than 30 days after termination of the Agreement, unless ComplyDo is subject to a legal obligation to retain Controller Data for a longer period. ComplyDo shall confirm deletion of Controller Data to Customer upon request.

12.2. During the term of the Agreement and until deletion of Controller Data pursuant to Section 12.1, Customer shall have the option to export its Controller Data. Upon request, ComplyDo shall make available the export functions provided for this purpose.

12.3. Documentation that serves as proof of the proper Processing of Controller Data in accordance with this DPA or for complying with statutory retention obligations may be retained by ComplyDo after expiry of the DPA.

13. Verifications and Audits

13.1. ComplyDo shall provide Customer, at Customer’s request, with all information necessary and available to ComplyDo to verify compliance with its obligations under this DPA and under Art. 28 GDPR.

13.2. Customer shall be entitled to review ComplyDo’s compliance with its obligations under this DPA and under Art. 28 GDPR.

13.3. Compliance with the obligations under this DPA and under Art. 28 GDPR shall, as a rule, be demonstrated by the provision of an appropriate and up-to-date attestation or report from an independent body or an audit report issued in connection with an IT security or data protection certification (e.g., ISO 27001).

13.4. To the extent that Customer substantiates a specific and justified suspicion of a breach of the obligations under this DPA or under Art. 28 GDPR, or if the evidence provided pursuant to Section 13.3 does not permit an adequate review in the specific case, Customer shall be entitled to conduct inspections. Such inspections shall be carried out with due regard to ComplyDo’s legitimate interests and, where possible, primarily by way of written information or remote reviews.

13.5. Inspections shall only be permissible during ComplyDo’s normal business hours and upon reasonable prior notice and shall not unreasonably interfere with ComplyDo’s business operations. Customer will not carry out more than one inspection per year unless: (i) Customer reasonably considers it necessary because of good faith concerns as to ComplyDo’s compliance with this DPA or Data Protection Laws; or (ii) Customer is required to carry out an audit by Data Protection Laws or a Supervisory Authority.

13.6. ComplyDo shall be entitled to restrict the disclosure of information to the extent necessary to preserve the confidentiality of other customers’ data, security requirements, and legitimate trade and business secrets. If Customer appoints a third party to carry out an inspection, such third party may not be a competitor of ComplyDo and must be bound in writing to confidentiality and non-disclosure prior to the inspection.

14. Liability

14.1 As between the Parties, the liability provisions of the MSA shall apply accordingly, including any exclusions and limitations of liability. The mandatory statutory liability provisions under Art. 82 GDPR shall remain unaffected.

15. Term and Termination

15.1. The term and termination of this DPA shall be governed by the provisions on the term and termination of the Agreement. Termination of the Agreement shall automatically result in termination of this DPA; this DPA shall, however, remain in force until the deletion of Controller Data has been completed. An individual termination of this DPA is excluded.

16. Final Provisions

16.1. Should individual provisions of this DPA be or become invalid or contain a gap, the remaining provisions shall remain unaffected. The Parties shall replace the invalid provision with a legally permissible provision that comes closest to the purpose of the invalid provision and meets the requirements of Art. 28 GDPR.

16.2. Unless otherwise provided in this DPA, the provisions of the Agreement shall apply accordingly, in particular with regard to the governing law and jurisdiction. In the event of contradictions between this DPA and other agreements between the Parties, in particular the Agreement, the provisions of this DPA shall take precedence.

16.3. Nothing in this DPA varies or modifies the Standard Contractual Clauses where they apply pursuant to Section 9.

Annex 1: Purpose, Nature, and Scope of Data Processing

Annex 2: List of Authorized Sub-processors

Annex 3: Technical and Organizational Measures

DPO: Prof. Dr. Max Moser, mm@blueheads.de, blueheads GmbH

Version 1.4

Effective date 15.09.2026

1. Introduction and Scope

1.1 Purpose

This document describes the technical and organizational measures (hereinafter "TOMs") implemented by Complydo Solutions GmbH to ensure a level of security appropriate to the risk of processing personal data, in accordance with Article 32 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

This document serves as:

• evidence of compliance with the accountability principle (Art. 5(2) GDPR);
• an annex to data processing agreements (DPA) pursuant to Art. 28 GDPR;
• an internal reference for staff, auditors, and supervisory authorities.

1.2 Scope

This TOM applies to:

• Processing activities covered: Collection, storage, use, transmission, access, support, maintenance, deletion, and other processing of customer and employee personal data by ComplyDo.
• Locations covered: Locations covered: ComplyDo's physical site at Linienstraße 214, 10119 Berlin, Germany, the ComplyDo-operated Microsoft Azure EU cloud environment, approved Google Cloud EU/Germany-region services used for contracted AI, language model, and translation functionality, the PostHog Cloud EU environment used for product analytics and AI observability, and the AWS EU region(s) used for AI inference via Amazon Bedrock.
• Systems covered: The ComplyDo Platform, related cloud infrastructure, identity and access management, operational support systems, and internal systems used to process customer or employee personal data.
• Categories of data subjects: Customer contacts, customer users, customer employees whose data is processed in the platform, ComplyDo employees, and other personnel or contractors where applicable.
• Categories of personal data: Contact data, account and access data, contractual data, billing and payment data, usage and log data, support and communication data, employee administration data, and personal data contained in customer-uploaded documents, evidence, files, prompts, outputs, analyses, or other customer-provided content. The ComplyDo Platform is not intended for the processing of special categories of personal data under Art. 9 GDPR, and customers must not use the platform for such data unless expressly agreed in writing. ComplyDo does not require special categories of personal data for standard platform operation. If such data is nevertheless included in customer-provided content, it is treated according to the applicable customer agreement, DPA, security measures, and deletion procedures.

1.3 Roles

• Controller / Processor: ComplyDo acts as a processor for personal data processed in the ComplyDo Platform on behalf of customers and in accordance with customer instructions, including customer-uploaded documents, evidence, files, prompts, outputs, analyses, and related platform data. ComplyDo acts as a controller where it independently determines the purposes and means of processing, including employee administration, internal corporate operations, customer relationship management, billing, vendor management, and compliance with legal obligations. Support and security-related processing are performed in the role applicable to the relevant processing purpose and as governed by the applicable customer agreement, DPA, and privacy information.
• Data Protection Officer (DPO): Prof. Dr. Max Moser, mm@blueheads.de
• Information Security Officer (ISO): Dagmar Moser, dm@blueheads.de
• Supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de

2. Risk Assessment Methodology

The measures described in this document have been selected on the basis of a risk-based approach in accordance with Art. 32(1) and (2) GDPR. The Company considers in particular:

• the state of the art;
• the costs of implementation;
• the nature, scope, context, and purposes of processing;
• the likelihood and severity of risks to the rights and freedoms of natural persons.

The risk assessment methodology applied is based on BSI IT-Grundschutz.

Risk assessments are documented separately and reviewed at least annually and after any significant change to processing activities, technology, or legal requirements.

3. Confidentiality (Art. 32(1)(b) GDPR)

3.1 Physical Access Control (Zutrittskontrolle)

Measures to prevent unauthorized physical access to data processing facilities:

• ComplyDo does not operate local server rooms or on-premise production infrastructure.
• Production infrastructure is operated primarily in the ComplyDo-operated Microsoft Azure EU cloud environment. Approved Google Cloud services may be used for contracted AI, language model, and translation functionality. Physical access protection for cloud data centers is provided by the respective cloud infrastructure provider.
• Access to ComplyDo office premises is restricted to authorized personnel.
• Visitors are accompanied by ComplyDo personnel while in ComplyDo-controlled office areas.
• Paper records containing personal data or confidential information are avoided where possible and stored securely when not in active use.
• Employees follow clear screen and clean desk practices.
• Work devices are configured to lock automatically after a maximum of 10 minutes of inactivity.
• Paper records containing personal data or confidential information are disposed of securely.

3.2 Logical Access Control (Zugangskontrolle)

Measures to prevent unauthorized use of data processing systems:

• Access to systems is granted through individual user accounts.
• Shared accounts are not used for productive access except where technically unavoidable.
• Employees must use work accounts for work services.
• Microsoft Entra ID is used for company identity and SSO-supported services.
• MFA is required for work services that support MFA.
• SMS-based MFA is not used unless no other temporary recovery option is available.
• Passwords for work services are generated and stored in Bitwarden EU with at least 24 characters.
• Passwords, credentials, and access tokens must not be shared through email, Slack, messenger services, files, or AI tools.
• Credentials are rotated without undue delay if compromise is suspected.
• Authentication and access events are logged where supported by the relevant system.
• Company work devices must use full disk encryption, endpoint protection, and managed update controls.

3.3 Data Access Control (Zugriffskontrolle)

Measures to ensure that authorized persons only access data covered by their authorization:

• Access rights are assigned based on role, least privilege, and need-to-know principles.
• Access to systems containing customer or employee personal data is limited to authorized personnel.
• Access grants, changes, and removals are handled through employee lifecycle, onboarding, offboarding, and tool administration processes.
• Access to production, infrastructure, identity, security, and organization-wide settings is restricted to authorized personnel.
• Customer data access by ComplyDo personnel is limited to personnel who require access for operation, support, security, or customer delivery.
• Access rights are reviewed when roles change, during offboarding, and as part of operational security checks.
• Access is revoked without undue delay when employment ends or access is no longer required.
• Administrative access is managed in each tool's native admin console and is not duplicated in static documentation.

3.4 Pseudonymization and Encryption (Art. 32(1)(a) GDPR)

• Personal data is protected by encryption in transit and at rest using platform, cloud, database, backup, and device encryption mechanisms appropriate to the relevant system. Production cloud storage, managed disks, backups, secrets, and certificates use provider-managed encryption at rest. Customer-managed encryption keys are not currently offered.
• Data transmissions involving personal data are protected using TLS 1.2 or higher, VPN, or equivalent secure transport mechanisms, depending on the transfer scenario.
• Production infrastructure and approved cloud services use Microsoft Azure and Google Cloud security controls, as applicable, for encryption, storage, infrastructure protection, and regional service configuration.
• Company laptops must use full-disk encryption, including FileVault on macOS.
• Production customer data must not be used in development environments unless anonymized, pseudonymized, or explicitly approved for a defined purpose.
• Pseudonymization or anonymization is applied where feasible and appropriate, especially for testing, analysis, troubleshooting, or other non-production purposes.

3.5 Key and Secret Management

• Production secrets, API keys, certificates, database credentials, authentication secrets, and infrastructure credentials are stored in approved secret management systems, including Azure Key Vault and Bitwarden EU, depending on the use case.
• Production workloads access Azure Key Vault through managed identities. Long-lived static credentials are avoided where a federated or managed identity mechanism is available.
• Secrets must not be committed to source code repositories, included in tickets, shared through chat, email, files, screenshots, or entered into AI tools.
• Access to secrets is restricted based on least privilege and operational need. Secret access and changes are logged where supported by the relevant platform.
• TLS certificates are renewed before expiry. Manually managed API keys, cryptographic application secrets, and service credentials are reviewed at least annually and rotated based on risk, provider support, personnel changes, suspected compromise, or material changes to the relevant integration.
• Credentials are rotated without undue delay if compromise is suspected or confirmed.

3.6 Separation Control (Trennungskontrolle)

Measures to ensure that data collected for different purposes can be processed separately:

• Production and development environments are separated.
• Production changes follow the defined development, review, and release process before deployment.
• Customer data is logically separated within the platform through tenant, role, and authorization controls.
• Access to customer data is limited based on customer context, role, and operational need.
• Internal company data, customer relationship data, legal documents, and engineering documentation are stored in separate systems or workspaces according to their purpose.
• Production customer data is not used in development environments unless anonymized, pseudonymized, or explicitly approved.

3.7 AI and Machine Learning Processing Security

• AI, language model, and retrieval services are used only through approved providers and approved integration paths.
• Customer data may be processed by approved Microsoft and Google services, where required for the contracted platform functionality and configured for the applicable customer, region, and processing context.
• Approved analytics and observability services receive only pseudonymous user and organisation identifiers and usage and trace metadata. No customer content is transmitted to them.
• Firecrawl AI is used only for retrieval or processing of external compliance reference materials, such as laws, regulations, and similar source material. No customer content, customer tenant data, or personal data is transmitted to Firecrawl.
• Customer prompts, uploaded content, model inputs, model outputs, and analysis results are logically associated with the relevant customer tenant and are protected by the same access control, confidentiality, logging, and retention rules as other customer content.
• AI provider use, data transfer implications, and sub-processor relevance are reviewed before a provider is approved for customer personal data processing.
• Providers or integrations not approved for customer personal data must not be used for customer content.

4. Integrity (Art. 32(1)(b) GDPR)

4.1 Transfer Control (Weitergabekontrolle)

Measures to ensure secure transmission of personal data:

• Customer documents and sensitive customer material are exchanged through approved platform, SharePoint, secure file transfer, or customer-specific workspace channels.
• Production internet-facing traffic is routed through Azure Application Gateway WAF v2, with HTTPS enforcement, TLS termination, managed OWASP rule sets, bot protection, WAF logging, and restricted backend ingress to reduce exposure to common web application attacks.
• Application ingress rules, network policies, and infrastructure configuration are reviewed when material changes are made to public endpoints, authentication flows, cross-origin access, or customer data flows.
• Remote access uses VPN, with MFA enabled for the relevant access path.
• Physical transfer of personal data carriers is avoided. Where physical transfer is required, it must follow documented secure transport procedures and be protected according to the sensitivity of the data.
• Significant data transfers and security-relevant transfer events are logged where supported by the relevant platform or cloud service.
• Data transfers to processors are governed by contractual safeguards, including data processing agreements where required under Art. 28 GDPR.
• Transfers outside the EU/EEA are permitted only where appropriate safeguards are in place, such as an adequacy decision, Standard Contractual Clauses, transfer impact assessment, and supplementary measures where required.

4.2 Input Control (Eingabekontrolle)

Measures to ensure traceability of data input, modification, and deletion:

• Create, read, update, and delete actions on personal data in core systems are logged where supported by the relevant system.
• Logs include relevant metadata where available, such as user ID, timestamp, action, affected record, source system, and event type.
• Platform and infrastructure logs are used for operational monitoring, security monitoring, incident investigation, and troubleshooting.
• Log retention is defined by log type. Application and operational container logs are generally retained for 90 days. Security-relevant audit logs, including Azure Activity Logs, AKS audit logs, Entra ID logs, and Bastion logs, are generally retained for 180 days. Key Vault audit logs are generally retained for 365 days because they relate to access to secrets and cryptographic material. Longer retention may apply where legally, contractually, or operationally required.
• Logs are protected against unauthorized access and modification through access controls and centralized log management or equivalent technical measures.
• Access to logs is restricted to authorized personnel with an operational, security, or support need.
• Source code and infrastructure changes are tracked through private Git repositories, reviewed through the defined development workflow, and supported by automated security checks where applicable.
• Product work, customer requests, bugs, and incident follow-up actions are tracked in Linear where applicable.

5. Availability and Resilience (Art. 32(1)(b) GDPR)

5.1 Availability Control (Verfügbarkeitskontrolle)

• Backups run every 6 hours.
• Backup retention is currently 7 days.
• Backups are encrypted.
• Restore tests are performed at least semi-annually and documented.
• Productive systems use cloud infrastructure mechanisms such as redundancy, clustering, load balancing, or equivalent managed service capabilities where appropriate.
• Endpoint protection is provided through Microsoft Defender on company Macs managed through Intune.
• Anti-malware protection is kept up to date on managed endpoints and relevant systems.
• Company devices must be kept up to date, including macOS and installed applications.
• Security patches are applied based on severity, with critical patches prioritized and regular patches applied within defined maintenance cycles.
• Monthly security maintenance checks cover Defender and Intune health, macOS updates, and application updates.
• Production internet-facing services use Azure platform-provided baseline DDoS protection for public endpoints, Azure Application Gateway WAF v2, bot protection, HTTPS enforcement, and network restrictions that prevent direct bypass of the WAF path.
• Azure alerts are used for security monitoring.
• Security-relevant alerts are escalated in accordance with the documented incident response and escalation procedure, including escalation to the Information Security Officer and responsible management where customer data or material business operations may be affected.

5.2 Resilience and Rapid Recovery (Art. 32(1)(c) GDPR)

• ComplyDo maintains documented business continuity and disaster recovery procedures for material service disruptions.
• Recovery responsibilities, escalation paths, and communication channels are defined for operational, security, customer-impacting, and externally sensitive incidents.
• The Recovery Time Objective (RTO) is 1 day.
• The Recovery Point Objective (RPO) is 6 hours, based on the backup cadence described in Section 5.1.
• Business continuity and disaster recovery procedures are tested at least annually.
• Test results, lessons learned, and required improvements are documented and tracked to completion.
• Incident response procedures define triage, ownership, escalation, communication, resolution, and post-incident review.
• Critical incidents require a post-incident review and corrective actions.

6. Procedures for Regular Testing, Assessment, and Evaluation (Art. 32(1)(d) GDPR)

• The TOM document and the underlying risk assessment are reviewed at least annually and after material changes.
• The DPO performs or coordinates an annual internal review of the TOM.
• Internet-facing systems are subject to penetration testing at least annually.
• Vulnerability scans are performed at least monthly for relevant internet-facing or security-critical systems.
• Findings from audits, penetration tests, vulnerability scans, incidents, and internal reviews are documented with assigned owners and deadlines.
• Source code and infrastructure changes are tracked in private Git repositories and follow the defined review and release workflow before production deployment.
• Security-relevant changes, including changes to authentication, authorization, exposed endpoints, secrets, logging, infrastructure, and customer data flows, are reviewed from a security perspective before release.
• Automated security checks are used in relevant development and deployment workflows, including secret detection, dependency vulnerability scanning, static application security testing, and infrastructure or container security checks where applicable.
• Findings from automated security checks, vulnerability scans, audits, penetration tests, incidents, and internal reviews are reviewed and remediated based on severity, exploitability, internet exposure, production impact, and customer data impact.
• Remediation progress is tracked until closure.
• Continuous monitoring, including SIEM, IDS, or IPS capabilities, is used where applicable to the relevant system or risk profile.
• External audits and certifications, including ISO 27001, are documented where applicable.

7. Organizational Measures

7.1 Data Protection Management

• ComplyDo maintains a documented data protection management approach integrated into its corporate governance.
• Records of processing activities are maintained and updated in accordance with Art. 30 GDPR.
• Data protection impact assessments are performed where required under Art. 35 GDPR.
• Privacy by design and privacy by default are considered for new or materially changed processing activities.
• Roles and responsibilities for data protection, information security, business ownership, controller activities, and processor activities are defined.
• Customer processing is governed by the applicable customer agreement and data processing agreement.
• New security, compliance, hosting, or data protection claims require review before external use.

7.2 Policies and Procedures

The Company maintains policies and procedures covering the following areas, available to employees:

• Information security
• Data protection
• Compliance
• Acceptable use of IT systems, email, and internet
• Access control
• Information classification and handling
• Retention and deletion
• Incident response
• Supplier and processor management

7.3 Staff Awareness and Training

• Employees receive mandatory data protection and information security training during onboarding and at least annually thereafter.
• Targeted training is provided for roles with elevated risk, including HR, IT administration, customer support, engineering, infrastructure, and security-relevant roles.
• Training participation and completion are documented.
• Employees with access to personal data are bound by confidentiality obligations.
• Confidentiality obligations are documented through employment or contractual arrangements.
• Employees are instructed to report suspicious activity, suspected account compromise, and accidental data exposure immediately.

7.4 Processor Management (Art. 28 GDPR)

• Processors are selected based on the nature of the service, processing activity, data protection relevance, security posture, region, transfer risk, and operational necessity.
• Before onboarding processors that handle personal data or security-relevant services, ComplyDo reviews available contractual, security, privacy, and compliance documentation. For large cloud providers, this may include public trust center materials, data protection addenda, standard contractual commitments, certification reports or summaries, region documentation, sub-processor lists, and provider security documentation.
• A list of approved processors and relevant sub-processors is maintained.
• Approved processors are reviewed at least annually and when there is a material change to the service, processing location, sub-processor chain, security posture, contractual terms, or data transfer setup.
• Sub-processors require approval in accordance with the applicable contractual arrangements.
• Transfers outside the EU/EEA require appropriate safeguards, such as an adequacy decision, Standard Contractual Clauses, transfer impact assessment, and supplementary measures where required.
• Post-termination deletion, return, and residual backup handling are assessed based on the applicable processor contract, data protection addendum, provider deletion commitments, and available assurance documentation. Bespoke deletion certificates from large cloud providers are not generally expected unless contractually available.

7.5 Data Subject Rights

• ComplyDo maintains procedures for handling data subject requests under Art. 15-22 GDPR, including access, rectification, erasure, restriction, portability, and objection.
• Requests are reviewed to determine whether ComplyDo acts as controller or processor for the relevant processing activity.
• Where ComplyDo acts as processor, ComplyDo supports the customer as controller in accordance with the applicable agreement and data processing agreement.
• Where ComplyDo acts as controller, requests are handled within one month, extendable by up to two further months where legally permitted for complex cases.
• Requester identity is verified where necessary before personal data is disclosed, corrected, deleted, or restricted.
• Data subject requests may be submitted through the DPO contact listed in Section 1.3 or through other official ComplyDo contact channels.
• Requests and responses are documented.

7.6 Data Breach Management

• ComplyDo maintains a documented procedure for detecting, assessing, escalating, and handling personal data breaches.
• Employees must report suspected data exposure, account compromise, or suspicious activity immediately.
• Incidents are assessed for confidentiality, integrity, availability, access control, customer data, and data protection impact.
• Where ComplyDo acts as controller, personal data breaches are notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, where required under Art. 33 GDPR.
• Where ComplyDo acts as a processor, ComplyDo notifies the affected customer as controller without undue delay after becoming aware of a personal data breach and within any additional timeframe agreed in the applicable DPA.
• Where ComplyDo acts as controller, affected data subjects are informed without undue delay where required under Art. 34 GDPR. Where ComplyDo acts as processor, ComplyDo supports the affected customer in fulfilling its obligations in accordance with the applicable DPA.
• An internal breach register is maintained.
• Breaches and security incidents are followed by corrective actions where required.
• Post-incident reviews are performed for critical incidents.

7.7 Retention and Deletion

• ComplyDo maintains retention rules for relevant data categories based on legal, contractual, operational, and business requirements.
• Customer data retention and deletion are governed by the applicable customer agreement and data processing agreement.
• Following termination of a customer agreement, customer production data is deleted or returned in accordance with the applicable agreement and DPA. Deleted customer data may remain in encrypted backups until the relevant backup retention period expires. The current production backup retention period is 7 days, unless a longer retention period is required by law, contract, security investigation, or documented legal hold.
• Personal data is deleted or anonymized when it is no longer required, unless retention is required by law, contract, or legitimate operational need.
• Automated deletion or anonymization is used where feasible.
• Physical records containing personal data or confidential information are disposed of securely.
• Physical media are securely erased or destroyed using methods appropriate to the media type, data sensitivity, and applicable security requirements.

8. Remote Work and Mobile Devices

• Remote work is permitted only through company-approved accounts, devices, and access paths.
• Personal devices must not be used for work unless explicitly approved under a controlled exception.
• Remote access to internal or restricted systems uses VPN with MFA where required by the relevant access scenario.
• Managed mobile devices are administered through mobile device management.
• Lost or stolen managed devices can be remotely locked or wiped where supported.
• Employees must ensure that personal data and confidential information are not visible or accessible to unauthorized persons when working remotely.
• Employees working from home or public locations must use appropriate safeguards, such as screen locking, private working areas, and secure storage of work materials.
• Work involving personal data must not be performed in public settings where third parties can view the screen or overhear confidential conversations.
• Public WiFi should be avoided for work; employees should use a trusted network or phone hotspot instead.
• Lost, stolen, compromised, or suspicious devices must be reported immediately.

9. Related Controlled Documents

ComplyDo maintains the following related documents separately. Their applicability, confidentiality, and availability to customers or auditors are determined based on the relevant contractual, legal, security, and confidentiality requirements:

• Records of Processing Activities (Art. 30 GDPR)
• List of Approved Sub-processors
• Risk Assessment Summary
• List of Certifications and Audit Reports
• Incident Response Plan Summary
• Retention and Deletion Schedule

10. Review and Acceptance

This document is reviewed at least annually and updated whenever there are material changes to processing activities, technologies, organizational structure, or applicable law.