Data Processing Agreement

2.1 Roles

For Customer Personal Data, Customer is controller (or processor on behalf of a third-party controller) and Productlane is processor (or sub-processor). For Customer Account Data and Customer Usage Data, Productlane acts as an independent controller (see Section 8).

2.2 Instructions

Productlane will process Customer Personal Data only (a) to provide, maintain, and secure the Services; (b) as documented in the Agreement and this DPA (including transfers); and (c) as otherwise documented by Customer's lawful instructions. Productlane will notify Customer if, in Productlane's opinion, an instruction infringes Data Protection Laws.

2.3 Details of processing

The subject matter, duration, nature and purpose of processing, categories of data subjects, and types of personal data are set out in Exhibit A.

2.4 Return / deletion

Upon termination of the Services or at Customer's written request, Productlane will delete or return Customer Personal Data (at Customer's choice) within 30 days, unless retention is required by law (in which case the data remains isolated and protected until the legal retention period expires, after which it is deleted). Certifications of deletion will be provided upon request where required by the EU SCCs / UK Addendum.

2.5 CCPA / CPRA

For Customer Personal Data, Productlane is a service provider / processor and will not sell or share such personal information nor use it for purposes other than providing the Services or as permitted by law.

4.1 Authorization

Customer provides general written authorization for Productlane to use Sub-processors to provide the Services.

4.2 List and updates

Current Sub-processors are listed in Exhibit B. Productlane will provide at least 15 days' prior notice of any new Sub-processor by updating Exhibit B and / or notifying Customer via email subscription. Customer may object on reasonable data-protection grounds within 10 days of notice. If no commercially reasonable alternative is available, Customer may suspend the affected Service (without prejudice to fees accrued).

4.3 Flow-down

Productlane will impose data protection obligations on Sub-processors equivalent to those in this DPA and remains liable for their acts and omissions.

5.1 Technical and organizational measures

Taking into account the state of the art, costs, and risks, Productlane implements appropriate technical and organizational measures to protect Customer Personal Data as described in Exhibit C (including encryption in transit and at rest, access controls, logging / monitoring, resilience, and backup / DR).

5.2 Confidentiality

Productlane ensures personnel accessing Customer Personal Data are subject to appropriate confidentiality obligations and receive security / privacy training.

5.3 Personal data breach

Productlane will notify Customer without undue delay and in any event within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information to assist Customer in meeting its legal obligations (including GDPR Articles 33 to 34), consistent with law enforcement or regulatory restrictions.

6.1 Assistance

Taking into account the nature of processing and available information, Productlane will assist Customer with DPIAs, data subject requests (see also Section 7), and security obligations under Data Protection Laws. Reasonable, documented costs of non-standard assistance may be charged.

6.2 Audit rights

Upon written request no more than once per 12 months, Productlane will provide (a) available third-party security reports / certifications or (b) where insufficient, permit Customer (or an independent auditor bound by confidentiality) to perform a reasonable audit of Productlane's data protection controls during normal business hours with 30 days' notice, without disrupting operations, and limited to facilities, systems, and records relevant to the Services and Customer Personal Data. Customer bears audit costs; Productlane may charge reasonable fees for support.

9.1 General

Customer Personal Data may be transferred and processed outside its origin country where necessary to provide the Services, subject to appropriate safeguards under Data Protection Laws.

9.2 EU / EEA / Switzerland

Where GDPR / Swiss FADP applies and Customer Personal Data is transferred to a country without an adequacy decision, the EU SCCs (2021/914) are incorporated by reference and deemed executed between the parties as completed below:

• Module Two (C2P) applies where Customer is controller and Productlane is processor;
• Module Three (P2Sub-P) applies where Customer is processor and Productlane is sub-processor.

For the EU SCCs: Clause 7 (Docking) not used; Clause 9 (general authorization; notice per Sec. 4.2); Clause 17 (governing law): Germany; Clause 18 (forum): Germany. Annex I / II / III details are in Exhibits A to C.

9.3 United Kingdom

For transfers under UK GDPR, the UK Addendum is incorporated and deemed executed (with Exhibits A to C completing the tables). If the ICO updates the Addendum, the newest version will automatically apply per its terms.

9.4 Supplementary measures

Productlane maintains supplementary technical / organizational / legal measures consistent with EDPB guidance (see Exhibit C) and will notify Customer of any government access requests to the extent legally permitted.

Subject matter and purpose

Productlane processes Customer Personal Data to provide the Productlane customer support platform (support inbox, live chat widget, customer portal, docs / help center, changelog, AI features), including hosting, storage, transmission, display, logging, support, security, troubleshooting, and product improvement (as processor).

Duration

For the term of the Agreement plus any legally required retention period.

Data subjects

Customer's end-users (the people who write into Customer's support inbox or use Customer's portal), Customer's support agents and other employees / contractors who access the Services, and any other individuals whose data Customer submits to the Services.

Categories of personal data

Typically business contact data (name, email, role), support messages and attachments (free-text may incidentally include personal data), usage metadata (timestamps, IPs, device / browser information), and configuration data. Customer does not need to submit special category / sensitive data for normal Service use.

Special categories

Not intended to be processed. If Customer elects to submit such data in support content, it will be processed under this DPA but is discouraged.

Processing operations

Collection, storage, retrieval, organization, transmission, display, deletion, and other operations necessary to deliver the Services per Customer's instructions.

Processor / Sub-processor roles

Customer = controller (or processor); Productlane = processor (or sub-processor).

Organization and policies

• Information Security Policy; Access Control; Acceptable Use; Secure SDLC; Vendor Management; Incident Response; Business Continuity and Disaster Recovery; Data Retention / Deletion.
• Roles and responsibilities defined; least privilege and need-to-know enforced.

Personnel security

• Confidentiality agreements for employees / contractors.
• Onboarding / offboarding with timely access provisioning / deprovisioning.
• Security and privacy awareness training at hire and at least annually.

Access controls

• Unique user IDs; MFA / SSO where supported; strong password policies.
• Role-based access control with periodic reviews; admin access restricted to authorized personnel.
• Production and non-production environments separated.

Infrastructure and network security

• Hosting on AWS (EU Frankfurt); private networking and security groups; Cloudflare WAF / CDN for internet-facing services.
• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Regular vulnerability management and dependency scanning; patch management through CI / CD workflows.
• Logging / monitoring with alerts (e.g., Sentry, platform logs).
• Backups in EU region with periodic restore testing; documented RTO / RPO.

Application security

• Secure development lifecycle with code review, CI checks, and dependency scanning.
• Secrets management; separation of duties for deploys and sensitive actions.
• Regular security testing (internal and / or independent); remediation tracked to closure by engineering leadership.

Endpoint security

• Company devices with full-disk encryption, screen-lock, and endpoint protection.
• Software installation restricted and monitored.
• Controls for removable media (restricted / encrypted where allowed).
• Ability to remotely wipe company data on lost / stolen devices (via device management or account revocation).

Incident response

• Documented plan with defined roles, triage, containment, eradication, recovery, and post-incident review.
• Customer notification without undue delay after awareness of a breach affecting Customer Personal Data; timelines consistent with applicable law (e.g., GDPR 72-hour rule).

Data subject rights and privacy

• Processes and tooling to export / delete Customer Personal Data upon Customer request.
• Data minimization and retention schedules tied to business / legal needs; secure deletion on request or contract end.

International transfers

• EU SCCs (2021/914) and UK Addendum incorporated; supplementary measures applied (encryption, access controls, policies, and challenge of government requests where permitted).