Datazag Data Processing Addendum

Version 2.1

Effective date 25 October 2026 for new acceptances

1. Scope, incorporation and order of precedence

1.1 This Data Processing Addendum ("DPA") is version 2.1, effective 25 October 2026 for new acceptances. It forms part of every agreement under which Datazag Ltd (company number 13217786, registered office 12 South Drive, Wokingham, England, RG40 2DH) ("Datazag") provides services to a customer, including the Datazag Terms of Service and the Datazag Partner Agreement (each a "Main Agreement").

1.2 This DPA applies only where Datazag processes Customer Personal Data as a processor or sub-processor. It does not apply to processing for which Datazag is an independent controller (clause 3.1).

1.3 If this DPA conflicts with a Main Agreement on the processing of personal data, this DPA prevails. The Standard Contractual Clauses and UK Addendum (clause 11) prevail over both, where they apply.

1.4 The Customer accepts this DPA when it accepts a Main Agreement that expressly incorporates this version and the Security and Sub-processor Schedule identified at acceptance. Datazag records the accepted versions and makes durable copies available. Existing agreements change only under their applicable amendment procedures. A countersigned copy may be requested from legal@datazag.com. This DPA does not retroactively replace an earlier accepted version.

2. Definitions

Other terms, such as controller, processor, data subject and processing, have the meanings given in the UK GDPR.

3. Roles

3.1 Independent controller. Datazag acts as an independent controller only for processing whose purposes and essential means it determines, such as its independently collected infrastructure intelligence, billing, business administration and its own fraud prevention or security. The Privacy Policy explains that processing. The classification depends on the actual activity, not the data label: submitted records, output, activity logs or account-related data processed solely to deliver Services on Customer instructions remain Customer Personal Data. Datazag must not reclassify instructed data as its own intelligence to avoid this DPA.

3.2 Processor. Datazag is a processor when it processes Customer Personal Data only to provide the Services on the Customer's documented instructions. Examples are personal data in domain lists, client lists, assessment requests, uploaded files or campaign data the Customer submits.

3.3 Sub-processor (partners and MSSPs). Where the Customer processes personal data as a processor for its own client, such as an MSSP acting for a Client under the Partner Agreement, Datazag acts as the Customer's sub-processor. The Customer confirms that its client has authorised this engagement, and that the Customer's instructions to Datazag are consistent with its client's instructions. The Customer passes on to Datazag any client instruction that affects the processing.

3.4 The parties do not intend any joint controllership. If a processing activity would require it, they will agree the necessary arrangement before that processing starts.

4. Customer obligations

4.1 The Customer is responsible for the lawfulness of its submissions and instructions in its role. Where it is controller, this includes lawful basis and required notices and consents. Where it is processor, it must obtain the controller's authorisation and relay lawful instructions; it does not assume duties that the law places solely on its controller. Datazag remains responsible for its own duties and processing.

4.2 The Customer's instructions are set out in the Main Agreement, this DPA, and its use of the Services' features. Further instructions must be in writing and consistent with the Services.

4.3 The Customer will not submit special category data, criminal offence data or children's data unless the Main Agreement expressly allows it.

5. Datazag obligations as processor

5.1 Datazag will process Customer Personal Data only on documented lawful Customer instructions, including for international transfers, unless required by law applicable to Datazag. It will notify the Customer of that requirement before processing unless legally prohibited. Mandatory SCC restrictions and safeguards continue to apply where relevant.

5.2 Datazag will notify the Customer immediately if, in its opinion, an instruction infringes Applicable Data Protection Law. It will suspend the affected processing where necessary and seek clarification or a lawful revised instruction. Customer confirmation alone does not authorise unlawful processing. Processing resumes only once the concern is resolved on reasonable grounds or a competent authority provides a lawful direction. Any termination follows the Main Agreement and mandatory transfer clauses.

5.3 Datazag will not use Customer Personal Data for its own purposes, including its own marketing, product development or its intelligence corpus. It will not sell or share it, or combine it with other data except as the Services require.

5.4 Datazag will ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.

5.5 Datazag must implement and maintain Annex 2 and the Security and Sub-processor Schedule before processing begins. It must select measures appropriate to risk under Applicable Data Protection Law. Updates must not reduce the overall level of protection or contradict mandatory transfer clauses. The applicable Schedule is incorporated by version and date and must accurately describe deployed controls.

6. Sub-processors

6.1 The Customer gives general written authorisation for the Sub-processors identified in the versioned Security and Sub-processor Schedule incorporated under Annex 3, available at /legal/subprocessors and in a durable copy at acceptance. Datazag must complete that Schedule before processing begins. A generic provider category or an unconfirmed supplier is not an authorised listed Sub-processor.

6.2 Datazag will send direct written notice to every affected Customer at its registered legal or account contact at least 30 days before a proposed new or replacement Sub-processor begins processing. Notice will identify the legal entity, function, processing and access locations, applicable transfer safeguards and objection deadline. A website update supplements and does not replace direct notice. Customers need not subscribe to an optional mailing list to receive it.

6.3 The Customer may object on reasonable data protection grounds within the notice period. The parties will promptly seek a reasonable alternative. Datazag must not send the objecting Customer's affected data to the proposed provider while the objection remains unresolved. If no reasonable alternative is available, either party may terminate the affected Services before the new processing begins, and Datazag will refund unused prepaid affected fees and provide return or deletion under Clause 10. An urgent legally required change must still satisfy authorisation and transfer requirements; if it cannot, affected processing must be suspended rather than continued unlawfully.

6.4 Datazag will put a written contract in place with each Sub-processor with data protection obligations no less protective than this DPA. Datazag remains liable to the Customer for each Sub-processor's performance.

7. Personal data breaches

7.1 Datazag will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The 48-hour limit is an outer limit, not permission to delay. An initial notice may contain incomplete information, supplemented without undue delay. Notice goes to the Customer's designated security contact or, if none, its registered account contact.

7.2 The notice will describe, as far as known: the nature of the breach; the categories and approximate numbers of data subjects and records; the likely consequences; and the measures taken or proposed. Datazag will provide further information as it becomes available.

7.3 Datazag will take reasonable steps to contain the breach and reduce its effects, and will help the Customer meet its own notification duties.

7.4 A notice is not an admission of fault or liability.

8. Assistance

8.1 Taking into account the nature of the processing, Datazag will provide reasonable assistance with:

1. responding to data subject requests about Customer Personal Data. Datazag will forward any request it receives directly to the Customer and will not respond itself, unless the law requires it;

2. data protection impact assessments and prior consultations with supervisory authorities, where these relate to the Services;

3. the Customer's security obligations and communications with supervisory authorities.

8.2 Reasonable, proportionate charges may apply to exceptional assistance beyond included support, with an estimate where practicable, except where caused by Datazag breach. Charges or payment disputes must not delay urgent legally required assistance or prevent exercise of statutory or mandatory transfer-clause rights.

9. Audits and information

9.1 Datazag will make available all information necessary to demonstrate compliance with its processor obligations, including relevant questionnaires, policy summaries and independent reports it actually holds. Routine questionnaires may be coordinated annually, but additional information must be provided where reasonably necessary for compliance, a material change, suspected breach or regulatory requirement.

9.2 Datazag will allow and contribute to audits and inspections by the Customer or an independent auditor it mandates, bound by confidentiality and proportionate security safeguards. Routine audits ordinarily require 30 days notice, occur during business hours and begin with document review; routine frequency is normally annual. Shorter notice, additional audits or direct inspection must be allowed where reasonably necessary after a breach, credible compliance concern, insufficient evidence or regulatory request. These arrangements must not obstruct statutory rights, controller oversight or mandatory SCC rights. Audits must protect other customers' information and avoid unnecessary disruption.

9.3 Each party bears its own reasonable audit costs. Any separately agreed charges for exceptional support must be proportionate, must not apply to remediation of Datazag breach, and must not obstruct the rights in Clause 9.2. Datazag will address identified non-compliance without undue delay.

9.4 Where Datazag is a sub-processor (clause 3.3), the Customer may share audit information with its client under confidentiality.

10. Return and deletion

10.1 On termination, the Customer may choose return or deletion of Customer Personal Data. Unless it requests earlier deletion, Datazag will provide a 30-day export window or a secure alternative return method. Following return, Datazag will delete remaining copies subject to Clause 10.3 and legally required retention. Historical Report licences do not authorise Datazag to retain personal data contrary to Customer instructions or law; the Customer is responsible for lawful retention of its exported copies.

10.2 Datazag will delete Customer Personal Data from production without undue delay and no later than 90 days after the Services end. An earlier written deletion instruction must be completed without undue delay and within 30 days of receipt, unless a shorter legal deadline applies. During any deletion window, data may be processed only for authorised export, deletion, security or mandatory retention. If law requires retention, Datazag will identify the requirement where legally permitted, isolate and protect the retained data, and delete it when the requirement ends.

10.3 Residual backups must be put beyond ordinary use when production deletion occurs and expire within a maximum of six calendar months after production deletion. This is a contractual maximum that Datazag must configure before processing begins; any shorter actual cycle is stated in the Security and Sub-processor Schedule. Backups may be accessed only for necessary recovery or legal requirements. If restored, deletion instructions must be reapplied promptly before normal access or further service use. Copies held by Sub-processors are subject to equivalent deletion duties.

10.4 Datazag will confirm deletion in writing on request.

11. International transfers

11.1 Datazag is based in the United Kingdom. The locations where it and its Sub-processors process Customer Personal Data are listed in Annex 3.

11.2 EEA-to-UK transfers may rely on the European Commission's UK adequacy decision while it is valid and covers the transfer. If that basis ceases to apply, the parties must establish a valid alternative before continuing the affected transfer; Clause 11.4 applies only where its conditions and required details have been completed.

11.3 Datazag will not initiate a restricted transfer, including onward processing or remote access by a Sub-processor, without a valid mechanism under Applicable Data Protection Law. Reliance on adequacy or an applicable Data Privacy Framework requires verification of the recipient legal entity, active certification and coverage of the data and transfer, including the UK Extension where relevant. Otherwise appropriate contractual safeguards, required assessments and supplementary measures must be implemented before transfer. Supplier contract location alone does not establish processing location or adequacy.

11.4 Where contractual transfer safeguards are required between the Customer and Datazag, the applicable official clauses must be incorporated without conflicting modification, with the required parties, modules, annexes and options completed under Annex 4 before transfer. For eligible EU transfers this means Decision (EU) 2021/914 Module 2 or Module 3, as applicable. For UK transfers this means the current approved UK Addendum to suitable SCCs or an agreed UK International Data Transfer Agreement. For Swiss transfers appropriate Swiss adaptations must be completed. Datazag is responsible for implementing appropriate safeguards for transfers it initiates to its own Sub-processors; Customer-to-Datazag paperwork does not itself cover those onward transfers. No incomplete annex is deemed a completed transfer instrument.

11.5 Datazag will carry out and keep transfer risk assessments for restricted transfers it makes, and will make a summary available on request.

11.6 Datazag will notify the Customer if it can no longer meet its obligations under a transfer mechanism, and will help find a lawful alternative.

12. US state privacy laws

12.1 Where applicable US privacy law requires Datazag to act as service provider, contractor, processor or equivalent for Customer Personal Data, it must meet that role's legal requirements. The Customer discloses the data only for the limited specified purposes in Annex 1 applicable to its ordered Services. Where the Customer acts for another business or controller, the parties must preserve the required chain of instructions, contractual restrictions and authorisations; status does not follow from a label alone.

12.2 Datazag will not:

1. sell or share Customer Personal Data, as those terms are defined in the CCPA;

2. retain, use or disclose it for purposes outside the specified business purposes, including unrelated commercial purposes, except as expressly permitted by applicable law;

3. keep, use or disclose it outside the direct business relationship with the Customer;

4. combine it with personal data from other sources, except as the CCPA allows for service providers.

12.3 Datazag will comply with the CCPA and give the same level of privacy protection it requires. It will tell the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorised use, and to check that Datazag uses the data in line with this DPA (clause 9).

12.4 Datazag certifies that it understands and will comply with these restrictions.

13. Liability, term and changes

13.1 Liability between the parties is subject to the applicable Main Agreement limits, including the enhanced data protection cap in Clause 16.4 where the Partner Agreement applies. No limit overrides mandatory SCC or UK transfer-clause rights, obligations or liability, or rights of data subjects or supervisory authorities that cannot lawfully be limited. The parties may not use this DPA to reduce mandatory transfer protections.

13.2 This DPA applies for as long as Datazag or its Sub-processors retain Customer Personal Data, including backups and legally retained records. All obligations relevant to that retention and processing survive, including confidentiality, security, instructions, assistance, incident notification, audits, deletion, transfer safeguards and applicable US restrictions. Return of one copy does not end obligations for remaining copies.

13.3 Datazag may propose updates on at least 30 days direct written notice, subject to the Main Agreement amendment procedure. Changes that reduce data protection or materially disadvantage the Customer require its express agreement unless strictly required by law. Necessary legal changes must be limited to that requirement with as much notice as practicable. No update overrides mandatory transfer clauses. Datazag records accepted versions, provides durable copies and keeps superseded versions accessible. Supplier changes follow Clause 6, rather than being silently implemented through a DPA update.

13.4 This DPA is governed by the law that governs the Main Agreement, except where the SCCs or UK Addendum require otherwise.

Annex 1 Description of processing

Subject matter: providing only the Services ordered under the Main Agreement, including domain and estate assessments, Health Reports, monitoring, related alert delivery and support; enrichment or campaign/deliverability analysis only where expressly ordered and authorised.

Nature and purposes: receive, store and analyse Customer submissions against Datazag intelligence; generate and deliver assessments and alerts; monitor authorised organisations; resolve support requests; and keep necessary service audit records. No own-purpose marketing, corpus ingestion or unrelated product training of Customer Personal Data is permitted.

Duration: the ordered service term, followed by limited return, deletion and lawful retention under Clause 10.

Data subjects: Customer and Client staff, business contacts and Prospects, and individuals identified in submitted infrastructure records.

Personal data: submitted names, business contact addresses, domain-linked identifiers, IP addresses linked to individuals, relevant assessment results and alert content, support correspondence and service activity logs processed on Customer instructions. Own-purpose account administration is distinguished under Clause 3.1.

Restricted categories: special category, criminal offence and children's data are not authorised unless expressly agreed with appropriate safeguards before submission.

Frequency: on request for assessments and support, and recurring for subscribed monitoring and alert delivery.

Retention: production deletion under Clause 10.2; residual backup expiry under Clause 10.3. Monitoring requires necessary configuration and domain lists during the active service. Assessment input, generated outputs and logs have distinct retention rules recorded in the Security and Sub-processor Schedule; no claim is made that all lists disappear immediately after generation.

Customer rights and duties: provide lawful instructions, select return or deletion, approve or object to Sub-processors, obtain compliance information and audits, and request required assistance, subject to this DPA and applicable law.

Alert destinations: delivery to a Customer-authorised Slack, SIEM or webhook destination is a documented instruction. The Customer must hold authority for that destination and its own downstream providers. Datazag must use appropriate secure delivery, maintain Client routing controls and avoid cross-Client disclosure. A Customer-selected destination is not automatically a Datazag Sub-processor. An intermediary Datazag engages to deliver the service is subject to Clause 6 where it processes Customer Personal Data on Datazag's behalf. Each party is responsible for transfers it initiates and must cooperate where allocation is unclear; destination selection does not excuse unlawful disclosure.

Sub-processor processing: only the specific authorised functions in Annex 3 and its incorporated Schedule; no general authorisation for unrelated services.

Annex 2 Minimum technical and organisational measures

These are contractual requirements to be implemented before Customer Personal Data processing starts and maintained throughout it. They are not claims of certification or independent audit. The incorporated Security and Sub-processor Schedule records implementation details without weakening these requirements.

Risk and security management: assess processing risks, maintain documented security responsibilities, review material changes and apply measures appropriate to confidentiality, integrity, availability and resilience.

Encryption: use supported TLS for external customer traffic and network service-to-service transfers of Customer Personal Data; encrypt production databases, stored files and backups at rest using provider-supported controls or equivalent effective safeguards. Protect keys and secrets through restricted managed access and rotation following compromise.

Access: named staff accounts, least privilege, production access MFA, prompt revocation on departure or role change, and periodic access review. Service identities use protected credentials and limited scopes; interactive MFA is not asserted for non-interactive service identities.

Separation: enforce Customer and Client authorisation checks and logical isolation; separate production from development; do not use live Customer Personal Data in development without documented authorisation and safeguards.

Minimisation and retention: collect only necessary data; document retention by data category and service; apply Clause 10 to exports, production, logs and backups; do not retain submitted data for unrelated intelligence use.

Logging: maintain proportionate security and access logs with restricted access, integrity safeguards and documented retention. Minimise personal data and secrets in logs; log content and retention must be recorded in the incorporated Schedule.

Resilience: maintain protected backups, a documented recovery procedure and periodic restoration tests. Backup expiry after production deletion must satisfy the six-calendar-month maximum in Clause 10.3.

Vulnerability management: maintain dependency and software updates, assess reported vulnerabilities, prioritise remediation by risk and remediate critical exposed issues promptly. Provide a working security reporting contact at legal@datazag.com, routed to the responsible security team.

People and suppliers: confidentiality duties and role-appropriate security training for personnel with data access; documented supplier due diligence, Article 28-equivalent contracts and authorised supplier changes.

Incidents: maintain an incident response procedure, escalation contacts and records supporting Clause 7; provide initial notice without waiting for a complete investigation.

Verification: periodically assess and test security effectiveness and record material remediation. Do not claim a certification, external audit or specific technology unless actually held or deployed.

Annex 3 Authorised Sub-processors and locations

The Security and Sub-processor Schedule at /legal/subprocessors, identified by version and date and delivered with this DPA at acceptance, forms this Annex. Before processing begins, it must identify each actual provider legal entity, specific function, affected data, storage and processing regions, support or remote access countries, contractual role and applicable transfer safeguard. No unnamed or unconfirmed supplier is authorised by this Annex.

Datazag must verify whether each provider acts as its processor, independent controller or another role for each activity; branding, group membership or login selection alone does not decide this. Payment, authentication, hosting, storage, delivery and report-worker services must be assessed. Customer-selected destinations are handled under Annex 1; Datazag-engaged intermediaries remain subject to Clause 6.

The same Schedule must record the actual implementation of Annex 2, input/output/log retention, backup cycle and legal/security contact routes. Direct supplier-change notices are required under Clause 6.

Annex 4 Completion of transfer safeguards

No SCC, UK Addendum or IDTA may be relied on for a transfer until its mandatory details and scope are completed and valid for that transfer.

EU SCCs: use the unmodified official Decision (EU) 2021/914 text for eligible transfers. Module 2 applies where the exporter is controller; Module 3 where it is processor, with required controller instructions and authorisation. Clause 7 docking is included. Clause 9 uses Option 2 with 30 days direct notice. The optional Clause 11 redress provision is not selected. Clauses 17 and 18 select Ireland law and Irish courts where legally suitable; mandatory data subject forum rights remain unaffected.

Parties: identify the actual exporter and importer legal entities, addresses, contacts, activities and roles in Annex I.A using the Customer acceptance record and applicable provider details; retain evidence of binding acceptance. Annex I.B must use Annex 1 supplemented with the actual transfer's data, frequency, purpose, retention and onward processing details. Annex II must specify deployed Annex 2 measures, not merely refer to incomplete controls.

Competent authority: Annex I.C must identify the authority selected under SCC Clause 13 for the actual exporter. If an EU establishment applies, use the responsible authority; where the exporter's Article 27 representative is relevant, use that Member State's authority; where the exporter is within Article 3(2) but exempt from appointing a representative, select an authority in a Member State where relevant data subjects are located. Ireland is not a default authority merely because neither establishment nor representative exists.

Sub-processors: supply the applicable Annex 3 details and the specific-authorisation annex where a selected instrument requires it. Assess onward transfers separately.

UK transfers: complete the current approved UK Addendum Tables 1 to 4 with the actual parties, selected SCC version and modules, annex information and both parties selected for the Section 19 approved-addendum-change termination option, or execute a suitable IDTA. Preserve all mandatory UK provisions and ICO jurisdiction requirements.

Swiss transfers: where required, complete an appropriate Swiss supplement, identifying the Swiss FADP, FDPIC and Swiss data subject enforcement protections without displacing EU protections where both regimes apply. A blanket substitution must not remove applicable GDPR rights.

Before transfer: verify the instrument's scope, assess destination risks under applicable law, implement necessary supplementary safeguards and establish a suspension or alternative mechanism if compliance fails. Completed transfer records are retained and made available as legally required.