Aethelis Data Processing Addendum

DRAFT — FOR LEGAL REVIEW

This Data Processing Addendum (“DPA”) is a working framework for engagements in which Aethelis processes personal data on behalf of a Customer.

The applicability and final contents of a DPA depend on the actual processing activity, jurisdictions, product architecture, and contractual relationship. Qualified privacy counsel should review the final document.

1. Scope

The executed DPA should identify the agreement it supplements and the processing activities to which it applies.

2. Roles of the parties

The final DPA should accurately identify the parties' roles for applicable processing rather than assuming controller, processor, business, service-provider, or other statutory classifications.

3. Processing instructions

Aethelis should process covered personal data according to documented Customer instructions and the executed agreement, subject to applicable legal requirements.

4. Processing details

The final DPA should include, as applicable:

• subject matter of processing;
• duration;
• nature and purpose;
• categories of personal data;
• categories of data subjects;
• applicable retention or deletion requirements.

These details must be based on the actual Customer engagement.

5. Confidentiality and authorized personnel

The final DPA should establish appropriate confidentiality obligations for personnel authorized to process covered personal data.

6. Security measures

Applicable security commitments should reflect measures actually implemented by Aethelis.

A separate security schedule may be incorporated after its contents have been validated.

7. Subprocessors

Any subprocessor provisions and any subprocessor list must reflect Aethelis's actual service-provider relationships and approved processing architecture.

No subprocessor list is created by this template.

8. Assistance

The final DPA should define applicable responsibilities concerning data-subject requests, security incidents, privacy assessments, and regulatory inquiries.

9. Security incidents

The final DPA should define the applicable security-incident notification obligations, scope, timing standard, and cooperation requirements.

No specific notification period is promised by this draft.

10. Return and deletion

The final agreement should specify applicable return, deletion, retention, and legal-preservation requirements following termination.

11. International transfers

Any international-transfer mechanism must be selected based on the actual jurisdictions and processing arrangement.

12. Audits and information rights

Any audit, assessment, documentation, or information rights should be established in the executed DPA.

13. Conflict

The final DPA should establish its order of precedence relative to the governing services agreement.

---

Privacy and legal review required before execution.