# Data Processing Agreement (template)

| | |
|---|---|
| Processor | IVERIOS OÜ, registry code 17516618, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia |
| Controller | The customer accepting the IVERIOS Terms of Service |
| Version | 1.0 — 6 November 2026 |
| Classification | Public |

This Data Processing Agreement ("DPA") forms part of the IVERIOS Terms of Service and governs the processing of personal data by IVERIOS on behalf of the customer in accordance with Article 28 of the GDPR.

## 1. Subject matter and duration
IVERIOS processes personal data to provide the IVERIOS services (trust center hosting, visitor access management, AI features) for the duration of the contract and the retention period set out in the Terms of Service.

## 2. Nature and purpose
Hosting, storage, display, translation and AI-assisted processing of content uploaded by the customer; management of trust center visitors (registration, NDA acceptance, approval, document downloads, chat).

## 3. Categories of data subjects and data
- Customer administrators: name, business e-mail, sign-in events.
- Trust center visitors: name, business e-mail, organisation, IP address, NDA acceptance, approval status, downloads, chat messages.
- Persons mentioned in documents uploaded by the customer (the customer should avoid uploading unnecessary personal data; a redaction function is provided).

No special categories of personal data are intended to be processed.

## 4. Obligations of IVERIOS
IVERIOS shall:
1. process personal data only on documented instructions of the customer;
2. ensure that persons authorised to process the data are bound by confidentiality (all team members sign an NDA);
3. implement appropriate technical and organisational measures (Annex 1);
4. engage sub-processors only under a written agreement with equivalent obligations, publish the list of sub-processors and inform the customer of intended changes at least 30 days in advance, giving the customer the opportunity to object;
5. assist the customer with data subject requests, security, breach notification and data protection impact assessments;
6. notify the customer of a personal data breach without undue delay — as a rule within a few hours of becoming aware of it and in any case no later than 72 hours;
7. at the end of the service delete all personal data (after the retention period stated in the Terms of Service) unless law requires storage, and make the data available for export before deletion;
8. make available information necessary to demonstrate compliance and allow for audits, including remote audits, on reasonable notice.

## 5. International transfers
Transfers outside the EEA take place only under Chapter V of the GDPR (e.g. Standard Contractual Clauses).

## 6. Liability and governing law
As set out in the Terms of Service.

## Annex 1 — Technical and organisational measures (summary)
- Encryption at rest for all storage; TLS for all traffic.
- Access with MFA for IVERIOS staff; least-privilege, role-based access; production access limited to authorised staff.
- Tenant isolation enforced on every request.
- Daily encrypted backups with automatic restore testing.
- Central logging and monitoring; weekly vulnerability scans; annual penetration test.
- Secure development with automated code and dependency review; deployment by authorised engineers only.
- NDA, onboarding and continuous security training for all staff.
- Incident response procedure with customer notification without undue delay.

## Annex 2 — Sub-processors
See the published *Sub-processor list*.