Data Processing Addendum

1.1 This DPA applies to personal data that the Processor processes on behalf of the Client in providing the services under the Agreement ("Client Personal Data"). It does not apply to data the Processor processes as a controller for its own business purposes, which is covered by its Privacy Notice.

1.2 "Data Protection Laws" means all laws on personal data that apply to the processing, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act"), and US state privacy laws. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR; under the DPDP Act, "Controller" means Data Fiduciary and "Processor" means Data Processor. Where a US state law applies, the Processor acts as a "service provider" or "processor" under that law.

1.3 If this DPA conflicts with the Agreement on the processing of Client Personal Data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

2.1 The Client is the controller and the Processor is the processor of Client Personal Data.

2.2 The Client is responsible for the lawfulness of the processing it instructs, including having a valid legal basis and giving any notices required, and for the accuracy of Client Personal Data it provides.

4.1 The Processor processes Client Personal Data only on the Client's documented instructions — the Agreement, this DPA, and any further written instructions — including with regard to transfers to a third country, unless required to do so by applicable law. In that case, the Processor will inform the Client of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. (GDPR Art. 28(3)(a).)

4.2 The Processor will immediately inform the Client if, in its opinion, an instruction infringes Data Protection Laws. (Art. 28(3), final paragraph.)

4.3 The Processor will not sell or share Client Personal Data, retain, use or disclose it outside the direct business relationship with the Client or for any purpose other than performing the services, or combine it with personal data received from other sources except as the services require and law permits.

5.1 The Processor ensures that everyone authorised to process Client Personal Data — employees, contractors and sub-processors — is bound by an appropriate contractual or statutory duty of confidentiality, receives appropriate data-protection training and accesses the data only as needed for the services. (Art. 28(3)(b).)

6.1 The Processor implements and maintains the technical and organisational measures required by GDPR Article 32, appropriate to the risk, including (Art. 28(3)(c)):

• Access control: least-privilege, role-based access; unique named accounts; multi-factor authentication on all business and engagement systems; prompt revocation of access when a person leaves or changes role.
• Encryption: TLS for data in transit; encryption at rest for devices and storage holding Client Personal Data; full-disk encryption on company laptops.
• Data minimisation in testing: evidence and screenshots are collected only as needed, with personal data redacted where possible; production data is not copied out of Client environments unless required and agreed.
• Endpoint and network security: managed endpoint protection, patching of operating systems and software, secure configuration baselines.
• Secure handling: engagement data stored only in approved systems, segregated per client; no use of personal devices or unapproved cloud services.
• Logging and monitoring of access to engagement systems.
• Backups and recovery for business systems, with restore testing.
• Personnel: confidentiality agreements, background checks where lawful, and regular security and privacy training.
• Supplier management: due diligence and written data-protection terms with every sub-processor.
• Regular testing and review of the effectiveness of these measures.

6.2 The Processor may update these measures provided the overall level of protection is not reduced.

7.1 The Client gives general written authorisation for the Processor to engage the sub-processors listed below. (Art. 28(2) and 28(3)(d).)

7.2 The Processor will give the Client at least 30 days' prior notice (by email to the Client's nominated contact, or by updating this page for clients who have subscribed to updates at connect@getbuckler.com) of any intended addition or replacement of a sub-processor. The Client may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, the Client may terminate the affected services and receive a refund of prepaid fees for services not yet performed.

7.3 The Processor imposes on each sub-processor, by written contract, data-protection obligations providing at least the same protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures (Art. 28(4)). The Processor remains fully liable to the Client for each sub-processor's performance.

8.1 Taking into account the nature of the processing, the Processor assists the Client by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under Data Protection Laws. (Art. 28(3)(e).)

8.2 If the Processor receives a request directly, it will forward it to the Client without undue delay and in any case within five business days, and will not respond itself except to direct the data subject to the Client, unless the Client instructs otherwise.

9.1 The Processor will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. (Art. 33(2).)

9.2 The notice will include, to the extent then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the name and contact details of the Processor's point of contact; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Information not available at first will be provided in phases without further undue delay.

9.3 The Processor will promptly take reasonable steps to contain, investigate and remediate the breach, preserve relevant evidence, and cooperate with the Client so it can meet its own obligations — including notifying supervisory authorities (within 72 hours under the GDPR), the Data Protection Board of India and affected individuals under the DPDP Act, or others as required. The Processor will not notify authorities or data subjects about a breach of Client Personal Data without the Client's approval, unless required by law.

9.4 Notification of a breach is not an acknowledgement of fault or liability.

9.5 Taking into account the nature of the processing and the information available to it, the Processor assists the Client in ensuring compliance with GDPR Articles 32 to 36 — security of processing, breach notification and communication, data protection impact assessments and prior consultation with supervisory authorities. (Art. 28(3)(f).)

10.1 At the end of the services, at the Client's choice, the Processor will return Client Personal Data to the Client and/or delete it, including existing copies, within 30 days, and confirm in writing on request — unless applicable law requires storage. (Art. 28(3)(g).) Data retained under law remains protected by this DPA and is processed only for the purpose required.

10.2 Deliverables (such as reports) retained in the Processor's professional records will have personal data minimised or redacted where practicable.

11.1 The Processor makes available to the Client all information necessary to demonstrate compliance with Article 28 and this DPA, and allows for and contributes to audits, including inspections, conducted by the Client or an independent auditor it mandates. (Art. 28(3)(h).)

11.2 The Processor will first answer written questionnaires and provide relevant policies and any independent certifications or reports. If that is not sufficient, or where required by a supervisory authority, the Client may conduct an audit on at least 30 days' written notice (shorter after a breach), no more than once in any 12 months (unless required by a supervisory authority or following a breach), during business hours, without unreasonably disrupting operations, and subject to confidentiality. Each party bears its own costs unless the audit reveals material non-compliance.

12.1 The Processor is established in India. Where Client Personal Data subject to the EU GDPR is transferred to the Processor or onward to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module Two (controller to processor), or Module Three (processor to processor) where the Client is itself a processor. Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, with the notice period in section 7.2) applies; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by, and disputes decided by the courts of, Ireland. Annexes I and II are completed by section 3 and section 6 of this DPA, and Annex III by the list in section 7.

12.2 For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) applies, with the tables completed by this DPA. For transfers subject to Swiss law, the SCCs apply with the adaptations required by the Swiss FDPIC.

12.3 Transfers of personal data out of India comply with any restrictions notified under section 16 of the DPDP Act.

13.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where law does not permit such limitation (including a party's liability to data subjects under the Standard Contractual Clauses).

13.2 This DPA remains in force for as long as the Processor processes Client Personal Data, and survives termination of the Agreement for that period.

13.3 Except for the Standard Contractual Clauses (see section 12), this DPA is governed by the law and dispute-resolution provisions of the Agreement, or, if the Agreement is silent, by the laws of India, with the courts at Pune, Maharashtra having exclusive jurisdiction.

Privacy and DPA contact: connect@getbuckler.com, SR No - 176, Suyog Space, Wakad, Pune, Maharashtra 411057, India. Email us for a countersigned copy of this DPA, with the Standard Contractual Clauses annexes completed for your engagement.

• Version 1.0 — 29 September 2026: first published version.