# Aethelis Data Processing Addendum

**DRAFT — FOR LEGAL REVIEW**

This Data Processing Addendum (“DPA”) is a working framework for engagements in which Aethelis processes personal data on behalf of a Customer.

The applicability and final contents of a DPA depend on the actual processing activity, jurisdictions, product architecture, and contractual relationship. Qualified privacy counsel should review the final document.

## 1. Scope

The executed DPA should identify the agreement it supplements and the processing activities to which it applies.

## 2. Roles of the parties

The final DPA should accurately identify the parties' roles for applicable processing rather than assuming controller, processor, business, service-provider, or other statutory classifications.

## 3. Processing instructions

Aethelis should process covered personal data according to documented Customer instructions and the executed agreement, subject to applicable legal requirements.

## 4. Processing details

The final DPA should include, as applicable:

- subject matter of processing;
- duration;
- nature and purpose;
- categories of personal data;
- categories of data subjects;
- applicable retention or deletion requirements.

These details must be based on the actual Customer engagement.

## 5. Confidentiality and authorized personnel

The final DPA should establish appropriate confidentiality obligations for personnel authorized to process covered personal data.

## 6. Security measures

Applicable security commitments should reflect measures actually implemented by Aethelis.

A separate security schedule may be incorporated after its contents have been validated.

## 7. Subprocessors

Any subprocessor provisions and any subprocessor list must reflect Aethelis's actual service-provider relationships and approved processing architecture.

No subprocessor list is created by this template.

## 8. Assistance

The final DPA should define applicable responsibilities concerning data-subject requests, security incidents, privacy assessments, and regulatory inquiries.

## 9. Security incidents

The final DPA should define the applicable security-incident notification obligations, scope, timing standard, and cooperation requirements.

No specific notification period is promised by this draft.

## 10. Return and deletion

The final agreement should specify applicable return, deletion, retention, and legal-preservation requirements following termination.

## 11. International transfers

Any international-transfer mechanism must be selected based on the actual jurisdictions and processing arrangement.

## 12. Audits and information rights

Any audit, assessment, documentation, or information rights should be established in the executed DPA.

## 13. Conflict

The final DPA should establish its order of precedence relative to the governing services agreement.

---

**Privacy and legal review required before execution.**