Data Processing Agreement

1. Roles and instructions

The Customer acts as controller or otherwise determines the relevant processing instructions, and Snapeted acts as processor or service provider to the extent applicable.

Snapeted will process personal data on documented instructions from the Customer, the Terms, and applicable law.

2. Confidentiality and security

Personnel authorized to process personal data will be subject to confidentiality obligations.

Snapeted will maintain technical and organizational measures appropriate to risk, including access controls, credential protection, logging, and recovery mechanisms.

3. Subprocessors

The Customer authorizes Snapeted to use subprocessors necessary to provide the service, subject to data-protection obligations consistent with this Agreement.

The subprocessor list may be updated as infrastructure and product features evolve.

4. Customer assistance

Taking into account the nature of processing, Snapeted will provide reasonable assistance with data-subject requests and obligations related to security, incidents, assessments, and regulatory consultations.

5. Incidents

After becoming aware of an incident compromising Customer data, Snapeted will notify the Customer without undue delay and within applicable legal requirements.

The notice will include, to the extent known, the nature of the incident, affected data, likely consequences, mitigation measures, and a responsible contact. Information may be supplemented as it becomes available.

6. Verification

Snapeted will make information available as reasonably necessary to demonstrate compliance with this Agreement and will permit reasonable audits by the Customer or an independent auditor bound by confidentiality.

Security restrictions and third-party confidentiality obligations will not be used to defeat a legally required verification.

7. Return and deletion

At the end of the services, subject to the Customer's choice and applicable legal obligations, personal data will be returned or deleted. The Customer may request an export and information about the procedure and timing before scheduled deletion.

Backups will remain restricted and will be deleted through their retention cycle; deletions must be reapplied if a backup is restored.

8. Transfers and precedence

International transfers subject to specific legal requirements will rely on the applicable safeguards.

This Agreement controls over conflicting provisions of the Terms with respect to processing personal data on the Customer's behalf.