Data Processing Agreement

1. Subject matter, duration, nature and purpose

Subject matter: quality-control inspection of the Controller's iOS, iPadOS and watchOS apps.

Duration: for the term of the order and until deletion under section 10.

Nature: accessing and using the Controller's app build and test accounts, capturing screenshots and screen recordings, and storing them in reports.

Purpose: to deliver the inspection report and related re-inspections requested by the Controller.

2. Categories of data and data subjects

Data subjects: test users and any end users whose data appears in the build or test environment the Controller provides; Controller staff.

Categories: whatever the Controller's app displays in the test environment, typically names, email addresses, usernames, profile content and app usage data. The Controller should provide test data only. Special categories of data (Art. 9) must not be included unless agreed in writing.

3. Processor obligations (Art. 28(3))

• (a) Process personal data only on documented instructions from the Controller, being the Terms, this DPA and the order, unless EU or Member State law requires otherwise, in which case we inform the Controller first unless the law forbids it.
• (b) Ensure that persons authorised to process the data, including inspectors and lead reviewers, are bound by confidentiality.
• (c) Take all measures required by Article 32 (see section 6).
• (d) Respect the conditions for engaging sub-processors (section 5).
• (e) Assist the Controller, taking into account the nature of processing, with appropriate technical and organisational measures to respond to data subject requests.
• (f) Assist the Controller in ensuring compliance with Articles 32 to 36, taking into account the information available to us.
• (g) At the Controller's choice, delete or return all personal data at the end of the services, and delete existing copies unless law requires storage.
• (h) Make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits (section 8).

We inform the Controller immediately if, in our opinion, an instruction infringes the GDPR or other data protection law.

4. Inspectors

Inspectors are independent contractors engaged by us. They act under our instructions, are bound by written confidentiality and data protection obligations, access data only through our systems for the orders assigned to them, and must not copy data to personal storage. For the purposes of this DPA they are persons authorised by the Processor, not separate sub-processors.

5. Sub-processors

The Controller gives general written authorisation for the following sub-processors:

• Supabase Inc.: database, authentication and file storage; data hosted in the EU (AWS eu-central-1, Frankfurt, Germany).
• Cloudflare, Inc.: application hosting, content delivery, security and inbound email routing; global network.
• Stripe Payments Europe, Ltd.: payment processing, invoicing and tax; Ireland, with transfers to Stripe, Inc. (US).
• Resend (Plus Five Five, Inc.): transactional email delivery; United States.

We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain liable for their performance. We give at least 30 days' notice of any new or replacement sub-processor by email to the account owner and on this page; the Controller may object on reasonable data protection grounds, and if we cannot accommodate the objection, may terminate the affected services and receive a pro-rata refund of prepaid fees.

6. Security measures (Art. 32)

• Encryption in transit (TLS 1.2+) and at rest; application-level AES-256-GCM encryption of demo credentials, with every decryption logged.
• Row-level security in the database so that only assigned inspectors, lead reviewers and authorised staff can access an order.
• Private storage buckets for evidence; time-limited signed URLs for viewing.
• Passwordless sign-in with one-time codes; rate limiting; audit logging of sensitive actions.
• Automatic deletion of demo credentials 7 days after delivery and of evidence 180 days after delivery.
• Least-privilege access for staff; confidentiality undertakings for all personnel and inspectors.

7. Personal data breaches

We notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Controller data, with the information required by Article 33(3) as it becomes available, and we cooperate with the Controller's response.

8. Audits

We make available on request our current security documentation and sub-processor certifications. The Controller may conduct an audit, at its own cost, once per year with 30 days' notice, during business hours and subject to confidentiality, or more often if required by a supervisory authority or following a breach.

9. International transfers

Where personal data is transferred outside the EEA, it is protected by an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor) where applicable, with supplementary measures as required.

10. Deletion and return

Demo credentials are deleted 7 days after delivery; evidence 180 days after delivery; reports remain available to the Controller in its account until the Controller deletes them or closes the account, after which they are deleted within 30 days, except where retention is required by law.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where the GDPR provides otherwise. If this DPA conflicts with the Terms, this DPA prevails for matters of personal data protection. Dutch law governs this DPA.