Data Processing Agreement

This Data Processing Agreement (the “Agreement”) governs Meteomatics Processing of Controller’s Personal Data when a customer accesses or uses Meteomatics’ services (the “Services”). By executing an Offer or otherwise using the Services, the entity or person accepting (“Customer” or “Controller”) agrees to the terms of this Agreement, which is incorporated by reference into the Meteomatics Terms and Conditions or other master agreement governing the Services (the “Main Agreement”).

WHEREAS, the Controller engages the Processor to provide certain services as specified in the Main Agreement;

WHEREAS, in the course of providing such services, the Processor may process Personal Data on behalf of the Controller;

WHEREAS, the Parties wish to lay down their rights and obligations to ensure compliance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the revised Swiss Federal Act on Data Protection (“FADP”) (collectively, “Data Protection Laws”).

NOW, THEREFORE, the Parties agree as follows:

1. Definitions

"AI System" means any software, model, tool, feature, or technical component that uses machine learning, logic-based, statistical, or other artificial intelligence techniques to generate outputs, predictions, recommendations, decisions, content, classifications, or other results from input data, including Personal Data, whether operating independently or as part of a broader product, service, or processing environment.

"Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject").

"Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automated means.

"Customer Personal Data" means any Personal Data Processed by Processor on behalf of Customer under the Agreement.

"Anonymized or Aggregated Data" means data originally derived from Customer Personal Data but rendered in such a manner that the individual is no longer identifiable and the data cannot be re-identified by the Processor.

"Sub-processor" means any third party engaged by Processor that Processes Customer Personal Data on behalf of the Processor. Full list of sub-processors here: https://www.meteomatics.com/en/privacy-policy/

"Technical and Organizational Measures" or "TOMs" means the security measures described in Annex 2 and any additional measures implemented by Processor in accordance with Article 32 GDPR.

"Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data and privacy, including but not limited to (a) the EU General Data Protection Regulation (Regulation (EU) 2016/679) ('EU GDPR'); (b) the UK General Data Protection Regulation as defined by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 ('UK GDPR'); (c) the UK Data Protection Act 2018; (d) the Swiss Federal Act of 25 September 2020 on Data Protection (Data Protection Act, FADP) (‘Swiss FADP’); and (e) any other applicable national data protection or privacy laws of any relevant jurisdiction, in each case as amended, updated, or replaced from time to time.

“Data Subjects” means identified or identifiable natural persons whose Personal Data is processed under this DPA, including, as applicable, the Controller’s employees, contractors, representatives, authorized users, customers, end users, suppliers, business partners, and any other individuals whose Personal Data is submitted to, accessed by, or otherwise processed by the Processor on behalf of the Controller.

2. Subject Matter and Scope

2.1. This Agreement applies to the Processing of Personal Data by the Processor on behalf of the Controller in the context of the services provided under the Main Agreement and any other written or online agreement with the Customer.

2.2. The details of the Processing (including subject matter, duration, nature, purpose, type of Personal Data, and categories of Data Subjects) are set forth in Annex 1 to this Agreement.

3. Obligations of the Processor

3.1. The Processor shall only process Personal Data on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union, Member State, or Swiss law. Processor shall, taking into account the nature of Processing and the information available, assist the Controller in carrying out data protection impact assessments and prior consultations with supervisory authorities as required by Articles 35 and 36 GDPR. Such assistance shall be provided taking into account the nature of the Processing and the information available to Processor and may be subject to reasonable charges where substantial additional effort is required.

3.2. The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3. The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures such as access control, encryption, and data minimization. Processor’s specific technical and organizational measures are set out in Annex 2.

3.4. Controller represents and warrants that it has all necessary rights, permissions, legal bases, and authorizations required under applicable Data Protection Laws for Processor to process Customer Personal Data in accordance with this Agreement and Controller's instructions. Controller shall remain solely responsible for the accuracy, quality, legality, and lawfulness of Customer Personal Data and the means by which such data was obtained.

4. Use of Artificial Intelligence

4.1. Processor may use artificial intelligence, machine learning, large language models, automated decision-support tools, and other similar technologies in connection with the development, provision, maintenance, support, security, and improvement of the Services and its internal business operations.

4.2. Processor shall not use Customer Personal Data to train, retrain, fine-tune, or otherwise improve any general-purpose artificial intelligence model, foundation model, or similar machine learning model unless expressly authorized by Controller in writing.

4.3. Nothing in this Agreement shall restrict Processor from using Customer Personal Data to provide the Services, generate outputs requested by Controller, detect security incidents, prevent fraud, troubleshoot issues, perform quality assurance activities, or comply with legal obligations.

4.4. Processor may use data that has been irreversibly anonymized such that no individual can reasonably be identified from the data, either directly or indirectly, for research, analytics, statistical purposes, service improvement, and development of products and services.

4.5. To the extent required by applicable Data Protection Laws, Processor shall provide information reasonably necessary to assist Controller in complying with its obligations relating to the use of artificial intelligence systems in connection with the Services. Nothing in this Agreement shall require Processor to disclose trade secrets, source code, model weights, proprietary algorithms, confidential business information, security measures, or information relating to other customers.

5. Data Subject Rights

5.1. The Processor shall, to the extent legally permitted, promptly notify the Controller of any request received from a Data Subject. Processor shall not respond to any Data Subject request except on documented instructions from the Controller or where required by Data Protection Laws.

5.2. Taking into account the nature of the Processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights.

6. Data Breach Notification

6.1. Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

6.2. The notification shall, at a minimum:

a) Describe the nature of the Personal Data Breach;

b) Communicate the name and contact details of the data protection officer or other contact point;

c) Describe the likely consequences of the Personal Data Breach; and

d) Describe the measures taken or proposed to be taken to address the breach.

7. Confidentiality Obligations

7.1. The Processor shall treat all Personal Data as strictly confidential and shall not disclose it to any third party, except as necessary to perform its obligations under the Main Agreement or as required by law.

7.2. The obligations of confidentiality shall survive the termination of this Agreement.

8. Sub-Processors

8.1. Controller hereby grants Processor a general written authorisation to appoint Sub-processors. Processor shall inform Controller of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, thereby giving Controller the opportunity to on reasonable, data-protection-related grounds within ten (10) business days of receipt of the notice. In the event of a valid objection, the Parties will in good faith discuss alternative solutions.

8.2. Where the Processor engages a sub-processor, it shall do so by way of a written contract imposing on the sub-processor the same data protection obligations as set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organizational measures and, where applicable, Standard Contractual Clauses (“SCCs”) or an equivalent transfer mechanism.

8.3. Processor shall not transfer Customer Personal Data to a country outside the European Economic Area, the United Kingdom, or Switzerland unless it ensures such transfer complies with Data Protection Laws. Where required, the Parties incorporate the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), including the Swiss FDPIC adaptations and, where applicable, the UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office, as amended from time to time.

9. Audit

Processor shall make available information reasonably necessary to demonstrate compliance with this Agreement, including relevant third-party audit reports, certifications, and summaries of security controls. Controller may conduct an audit only where such information is insufficient to demonstrate compliance and only upon reasonable written notice, during normal business hours, no more than once annually, and subject to Processor's security, confidentiality, and operational requirements. Audits shall not include penetration testing, access to source code, or access to information relating to other customers.

10. Return and Deletion of Data

Upon termination or expiration of the Main Agreement, Processor shall delete or return Controller’s Personal Data, unless retention is required by applicable law or maintained in routine backup systems, and shall confirm completion upon Controller's written request.

11. Additional Assistance and Costs

Where Controller requests assistance, information, documentation, audits, investigations, assessments, reports, or other support beyond Processor's obligations under applicable Data Protection Laws or this Agreement, Processor may charge reasonable fees for such assistance.

12. Liability and Indemnification

12.1. Each Party's liability arising out of or related to this Agreement shall be subject to the limitations of liability set forth in the Main Agreement. Nothing in this Agreement shall limit either Party’s liability for wilful misconduct or gross negligence.

12.2. The Processor shall be liable for the damage caused by Processing only where it has not complied with obligations of the Data Protection Laws specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Controller.

12.3. Any claims arising from a Party's breach of this Agreement shall be governed exclusively by the liability and remedies provisions of the Main Agreement.

13. Governing Law and Jurisdiction

This Agreement, and any dispute or claim (contractual or non-contractual) arising out of or in connection with it, its subject matter or formation, shall be governed by and construed in accordance with the substantive laws of Switzerland, excluding its conflict of law rules and the United Nations Convention on Contracts for the International Sale of Goods. The competent courts of St. Gallen, Switzerland, shall have exclusive jurisdiction to settle any such dispute, and each Party irrevocably submits to the jurisdiction of such courts.

14. Entire Agreement

This Agreement is the final, complete and exclusive agreement of the Parties with respect to the subject matters hereof and supersedes and merges all prior discussions between the Parties with respect to such matters. Processor may update this Agreement where required by applicable law. Any material change adversely affecting Controller's rights shall require mutual written agreement unless such change is necessary to comply with applicable law.

ANNEX I: DETAILS OF PROCESSING

1. Subject Matter of the Processing

The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the services described in the Agreement, including any related support, maintenance, security, operational, administrative, and contractual activities necessary to perform such services.

2. Duration of the Processing

The Processor shall process Personal Data for the duration of the Agreement, unless otherwise required by applicable law or instructed by the Controller. Following termination or expiry of the Agreement, the Processor shall return or delete Personal Data in accordance with the Agreement and applicable Data Protection Laws.

3. Nature and Purpose of the Processing

The nature of the Processing may include, as applicable: collection, recording, organization, structuring, storage, hosting, adaptation, alteration, retrieval, consultation, use, transmission, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure, and destruction of Personal Data.

The purpose of the Processing is to enable the Processor to provide, operate, maintain, secure, monitor, improve, and support the services provided to the Controller under the Agreement, and to comply with documented instructions from the Controller and applicable legal obligations.

4. Categories of Data Subjects

Personal Data processed under the Agreement may relate to the following categories of Data Subjects, as applicable:

(a) employees, contractors, consultants, representatives, and other personnel of the Controller;

(b) authorized users, administrators, and account holders of the services;

(c) customers, end users, business partners, suppliers, or other third parties whose Personal Data is submitted to or processed through the services by or on behalf of the Controller;

(d) individuals who communicate with the Controller or Processor in connection with the services; and

(e) any other Data Subjects whose Personal Data is provided by or on behalf of the Controller in connection with the Agreement.

5. Categories of Personal Data

Personal Data processed under the Agreement may include, as applicable:

(a) identification data, such as name, username, title, role, employer, customer ID, or account identifier;

(b) contact data, such as business email address, telephone number, postal address, or other communication details;

(c) account and authentication data, such as user IDs, access rights, login credentials, authentication tokens, and security logs;

(d) technical and usage data, such as IP addresses, device identifiers, browser type, operating system, log files, telemetry, metadata, access records, and usage information;

(e) communication data, such as correspondence, support requests, messages, tickets, comments, or feedback;

(f) contractual and billing-related data, such as company name, order details, invoice information, transaction references, and payment status, excluding full payment card data unless expressly agreed;

(g) service content, files, records, datasets, or other information uploaded, submitted, generated, transmitted, or otherwise made available by or on behalf of the Controller through the services; and

(h) any other Personal Data processed by the Processor on behalf of the Controller in accordance with the Agreement.

6. Special Categories of Personal Data

The Controller shall not submit Special Categories of Personal Data to the services unless expressly permitted under the Agreement or otherwise agreed in writing by the Parties.

Where Special Categories of Personal Data are processed, such data may include, as applicable, Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying an individual, health data, or data concerning a person’s sex life or sexual orientation.

7. Sensitive or Highly Confidential Data

The Controller shall not submit highly confidential, regulated, or sensitive data to the services unless expressly permitted under the Agreement or otherwise agreed in writing by the Parties.

Such data may include, as applicable: government-issued identification numbers, financial account data, payment card data, criminal offence data, children’s data, precise location data, confidential business information, credentials, secrets, or other data subject to heightened legal, contractual, or security requirements.

8. Frequency of Processing

Personal Data may be processed on a continuous, regular, periodic, or occasional basis, depending on the Controller’s use of the services and the nature of the Processing activities performed under the Agreement.

9. Processing Operations

The Processor may perform the following Processing operations, as applicable:

(a) provision, configuration, operation, hosting, and maintenance of the services;

(b) creation, management, authentication, and administration of user accounts;

(c) storage, retrieval, transmission, and deletion of Personal Data;

(d) monitoring, logging, troubleshooting, debugging, and technical support;

(e) security monitoring, access control, incident detection, investigation, and remediation;

(f) backup, recovery, business continuity, and disaster recovery activities;

(g) service updates, testing, quality assurance, and performance optimization;

(h) customer support, account management, and communications related to the services;

(i) compliance with documented Controller instructions, legal obligations, and contractual requirements; and

(j) return or deletion of Personal Data upon termination or expiry of the Agreement.

10. Location of Processing

Personal Data may be processed in the countries, regions, or hosting locations specified in the Agreement, the applicable order form, the Processor’s sub-processor list, or other written documentation made available by the Processor.

Where Personal Data is transferred internationally, the Parties shall implement appropriate safeguards as required under applicable Data Protection Laws.

11. Sub-Processors

The Processor may engage Sub-Processors to support the provision, operation, maintenance, security, hosting, support, or administration of the services, subject to the requirements of the Agreement.

The Processor shall ensure that Sub-Processors are bound by written obligations that are substantially equivalent to those imposed on the Processor with respect to the protection of Personal Data.

12. Retention Period

Personal Data shall be retained for no longer than necessary to provide the services, comply with documented Controller instructions, meet legal or contractual obligations, resolve disputes, enforce agreements, maintain security, or complete backup and deletion cycles.

Upon termination or expiry of the Agreement, Personal Data shall be returned or deleted in accordance with the Agreement, unless retention is required by applicable law.

13. Technical and Organizational Measures

The Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, as further described in Annex II Technical and Organizational Measures.

14. Controller Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by applicable law. Where the Processor is required by law to process Personal Data other than on the Controller’s instructions, the Processor shall inform the Controller of that legal requirement before Processing, unless prohibited by law.

15. Assistance to the Controller

Taking into account the nature of the Processing and the information available to the Processor, the Processor shall provide reasonable assistance to the Controller in fulfilling the Controller’s obligations under applicable Data Protection Laws, including obligations relating to Data Subject requests, security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities.

16. Return or Deletion of Personal Data

At the choice of the Controller, and subject to the Agreement and applicable law, the Processor shall delete or return Personal Data after the end of the provision of services relating to Processing, and shall delete existing copies unless applicable law requires storage of the Personal Data.

Deletion from backups may occur in accordance with the Processor’s standard backup retention and deletion cycles, provided that Personal Data retained in backups remains protected in accordance with the Agreement.

ANNEX II: Technical and Organizational Measures (TOMs)

1. Purpose and Scope

This Annex describes the technical and organizational measures implemented by the Processor to protect Personal Data processed on behalf of the Controller. The measures are designed to ensure a level of security appropriate to the risk, taking into account the nature, scope, context, and purposes of the Processing, the state of the art, implementation costs, and the risks presented to Data Subjects.

The Processor maintains an information security management system aligned with ISO/IEC 27001:2022 and applies security controls based on risk assessment, applicable legal requirements, contractual obligations, and the nature of the services provided.

2. Information Security Governance

The Processor maintains documented information security policies and procedures approved by management and communicated to relevant personnel. Roles and responsibilities for information security, data protection, risk management, incident response, access control, supplier management, and business continuity are defined and assigned.

The Processor periodically reviews its information security policies, procedures, and controls to ensure their continued suitability, adequacy, and effectiveness.

3. Risk Management

The Processor maintains a risk management process to identify, assess, treat, and monitor information security and data protection risks. Risk assessments are performed periodically and when material changes occur, including changes to systems, infrastructure, suppliers, processing activities, or threat environment.

Risk treatment measures may include technical controls, organizational controls, contractual safeguards, monitoring, training, or acceptance of residual risk by management.

4. Access Control

The Processor implements access controls designed to ensure that only authorized personnel may access Personal Data, systems, and facilities necessary for their assigned duties.

Measures include, as applicable:

(a) unique user accounts for personnel with access to systems processing Personal Data;

(b) role-based access control and least-privilege principles;

(c) approval procedures for granting, modifying, and revoking access;

(d) periodic access reviews;

(e) timely revocation or adjustment of access upon role change or termination;

(f) multi-factor authentication for administrative, privileged, remote, or other high-risk access;

(g) password or authentication requirements aligned with recognized security practices; and

(h) logging and monitoring of access to relevant systems.

5. Personnel Security and Confidentiality

The Processor ensures that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, whether by employment agreement, contractor agreement, policy, or other binding obligation.

The Processor provides information security and data protection awareness training to relevant personnel. Additional training may be provided to personnel with elevated access, security responsibilities, administrative privileges, or roles involving regular handling of Personal Data.

6. Asset Management

The Processor maintains processes to identify, classify, manage, and protect information assets, including systems, applications, infrastructure, devices, and information repositories used to process Personal Data.

Personal Data is handled according to its classification, sensitivity, contractual requirements, and applicable legal obligations. The Processor maintains procedures for secure use, transfer, storage, retention, and disposal of information assets.

7. Encryption and Cryptographic Controls

The Processor uses cryptographic controls where appropriate to protect Personal Data against unauthorized access, disclosure, alteration, or loss.

Measures include, as applicable:

(a) encryption of Personal Data in transit using industry-standard protocols;

(b) encryption of Personal Data at rest where appropriate based on risk and system architecture;

(c) secure management of cryptographic keys;

(d) restriction of key access to authorized personnel or systems; and

(e) periodic review of cryptographic configurations and protocols.

8. Network and Communications Security

The Processor implements network security controls designed to protect systems and Personal Data from unauthorized access, misuse, or compromise.

Measures include, as applicable:

(a) network segmentation or logical separation of environments;

(b) firewalls, security groups, access control lists, or equivalent controls;

(c) secure remote access mechanisms;

(d) monitoring of network activity for security-relevant events;

(e) protection against malware, unauthorized connections, and malicious traffic;

(f) secure configuration of network services; and

(g) controls for data transfer between systems, environments, and authorized third parties.

9. System Security and Secure Configuration

The Processor maintains secure configuration standards for systems, applications, cloud services, endpoints, and infrastructure components used to process Personal Data.

Measures include, as applicable:

(a) hardening of systems and services;

(b) removal or disabling of unnecessary services, ports, accounts, and default credentials;

(c) vulnerability management and remediation procedures;

(d) patch management based on risk and severity;

(e) endpoint protection or equivalent controls;

(f) logging of security-relevant system events; and

(g) administrative access restrictions.

10. Secure Development and Change Management

Where the Processor develops or maintains software, applications, APIs, integrations, scripts, infrastructure-as-code, or other technical components used to process Personal Data, it applies secure development and change management practices.

Measures include, as applicable:

(a) documented change approval, testing, and deployment procedures;

(b) segregation of development, testing, staging, and production environments where appropriate;

(c) code review or equivalent quality control;

(d) security testing appropriate to the risk of the change;

(e) protection of source code repositories;

(f) management of secrets, credentials, and configuration data;

(g) vulnerability remediation processes; and

(h) rollback or recovery procedures for material changes.

11. Logging, Monitoring, and Detection

The Processor maintains logging and monitoring measures designed to detect, investigate, and respond to security events affecting systems that process Personal Data.

Measures include, as applicable:

(a) logging of user, administrative, authentication, access, and system events;

(b) protection of logs against unauthorized alteration or deletion;

(c) retention of logs for an appropriate period based on legal, contractual, operational, and security requirements;

(d) monitoring for suspicious or unauthorized activity;

(e) alerting and escalation procedures for relevant security events; and

(f) periodic review of monitoring effectiveness.

12. Vulnerability and Malware Protection

The Processor maintains controls to identify, evaluate, and remediate vulnerabilities in systems used to process Personal Data.

Measures include, as applicable:

(a) vulnerability scanning or security assessments;

(b) remediation prioritization based on severity, exploitability, exposure, and business impact;

(c) patching or compensating controls for identified vulnerabilities;

(d) malware prevention, detection, and response controls;

(e) restrictions on unauthorized software; and

(f) review of security advisories relevant to the Processor’s systems and services.

13. Physical and Environmental Security

The Processor applies physical and environmental security controls to protect premises, equipment, and infrastructure under its control.

Measures include, as applicable:

(a) controlled physical access to offices, work areas, and equipment;

(b) visitor management procedures;

(c) protection of devices against theft, loss, or unauthorized access;

(d) secure storage and disposal of physical media;

(e) environmental protections such as fire detection, climate control, or power protection where relevant; and

(f) reliance on data center, cloud, or hosting providers with appropriate physical and environmental security controls.

14. Supplier and Sub-Processor Security

The Processor maintains procedures for assessing, approving, and monitoring suppliers and Sub-Processors that may affect the security or confidentiality of Personal Data.

Measures include, as applicable:

(a) risk-based supplier due diligence;

(b) written agreements imposing confidentiality, security, and data protection obligations;

(c) review of supplier security documentation, certifications, or assurance reports where appropriate;

(d) monitoring of supplier performance and material changes;

(e) restrictions on unauthorized sub-processing; and

(f) procedures for managing supplier termination or transition.

15. Data Segregation and Tenant Separation

The Processor implements logical, technical, and organizational measures designed to prevent unauthorized access to Personal Data between customers, tenants, environments, users, or processing contexts.

Measures may include access controls, environment separation, database-level restrictions, application-level authorization, network segmentation, encryption, configuration controls, and monitoring.

16. Backup, Recovery, and Availability

The Processor maintains measures designed to preserve the availability and resilience of systems processing Personal Data.

Measures include, as applicable:

(a) regular backups of relevant systems or data;

(b) protection of backups against unauthorized access, alteration, and deletion;

(c) backup retention periods based on operational, legal, and contractual requirements;

(d) periodic testing or validation of backup and recovery procedures;

(e) redundancy, failover, or resilience controls where appropriate; and

(f) documented recovery procedures.

17. Business Continuity and Disaster Recovery

The Processor maintains business continuity and disaster recovery measures designed to support continued provision of services and restoration of availability following disruptive events.

Measures include, as applicable:

(a) documented continuity and recovery procedures;

(b) identification of critical systems, dependencies, and recovery priorities;

(c) periodic review or testing of continuity and recovery arrangements;

(d) incident escalation and crisis management procedures;

(e) backup communication channels where appropriate; and

(f) post-event review and improvement activities.

18. Incident Management and Personal Data Breach Response

The Processor maintains an incident management process to identify, report, assess, respond to, and document information security incidents, including incidents that may involve Personal Data.

Measures include, as applicable:

(a) procedures for internal reporting and escalation of suspected incidents;

(b) triage and assessment of security events;

(c) containment, eradication, recovery, and remediation activities;

(d) documentation of incident facts, impact, actions taken, and lessons learned;

(e) procedures to support notification obligations under the Agreement and applicable Data Protection Laws; and

(f) cooperation with the Controller in relation to Personal Data Breach assessment, investigation, mitigation, and notification.

19. Data Retention, Return, and Deletion

The Processor retains Personal Data only as necessary for the purposes of the Processing, as instructed by the Controller, or as otherwise required by applicable law.

Upon expiry or termination of the relevant services, the Processor will return or delete Personal Data in accordance with the Agreement, documented instructions from the Controller, and applicable legal retention requirements. Deletion procedures are designed to prevent reconstruction of deleted Personal Data using commercially reasonable means, subject to backup retention cycles and legal obligations.

20. Secure Disposal and Media Handling

The Processor applies procedures for secure disposal, reuse, or destruction of media, devices, and storage resources containing Personal Data.

Measures include, as applicable:

(a) secure deletion, sanitization, or destruction of media;

(b) restrictions on removable media;

(c) inventory and handling procedures for relevant assets;

(d) protection of devices during transfer, repair, replacement, or disposal; and

(e) use of qualified service providers for secure destruction where appropriate.

21. Privacy and Data Protection by Design

The Processor applies privacy and data protection considerations when designing, developing, implementing, or materially changing systems or services used to process Personal Data.

Measures include, as applicable:

(a) minimization of Personal Data processed;

(b) limitation of access to Personal Data;

(c) use of pseudonymization, anonymization, aggregation, or masking where appropriate;

(d) assessment of privacy and security risks before material changes;

(e) implementation of controls to support Controller instructions; and

(f) maintenance of records or documentation relevant to processing activities.

22. Audit, Assurance, and Continuous Improvement

The Processor periodically evaluates the effectiveness of its technical and organizational measures through internal reviews, risk assessments, audits, control testing, vulnerability assessments, management reviews, or other assurance activities.

Where applicable, the Processor may maintain third-party certifications, audit reports, or independent assessments relevant to its information security management system. Identified deficiencies are tracked and remediated based on risk, severity, and operational priority.

23. Updates to Measures

The Processor may update or modify the technical and organizational measures from time to time, provided that such updates or modifications do not materially reduce the overall level of security provided for Personal Data under the Agreement.