Data Processing Agreement

Effective: 2 November 2026

Last updated: 2 November 2026

Version: 1.1

1. Introduction and role

1.1 What this agreement is

This Data Processing Agreement (the "DPA") forms part of the Sysplore Terms of Service. It applies automatically to every customer that uses the Products or Sysplore Cloud to process personal data, from the moment the account is created and without a signature. If you need a countersigned copy for your records, email [email protected] and we will send one.

1.2 The parties and their roles

In this DPA, you are the controller and Sysplore LLC ("Sysplore", "we", "us" or "our") is the processor, within the meaning of Article 28 of the General Data Protection Regulation (EU) 2016/679 (the "GDPR"). Where you act as a processor for your own customers, we are your subprocessor and this DPA applies as it applies to a processor. We are established in the United States. You choose the region where your Content is stored when you sign up, the European Union or the United States, and we process it in that region. The terms defined in section 2 of the Terms of Service, including "Content", apply to this DPA.

2. Scope of processing

This DPA covers the personal data we process to provide the Products, Sysplore Cloud and, where we process personal data for you under a Contract, the Professional Services. Annex I records the subject matter, the duration, the nature and the purpose of the processing. This DPA does not cover personal data that we process for our own purposes as a controller, which the Privacy Policy describes.

2.1 Data region

You choose the region where your Content is stored when you sign up or buy: the European Union or the United States. We store and process your Content, and the account data associated with it, in the region you choose. Where our personnel or a subprocessor access that data from outside the region, the transfer is covered by section 8.

3. Personal data and data subjects

Annex I records the categories of personal data and of data subjects. In summary, the personal data includes the identifiers and contact details of your End Users, the account data that keeps the Service running, and the Content you store, which may include the personal data of the people you correspond with and of anyone named in what you store. The data subjects are your End Users, the people who appear in your Content, and your own customers where you act as their processor.

4. Instructions

We process personal data only on your documented instructions. Your instructions are the Terms of Service, this DPA, the settings you and your End Users configure, and the actions you take in the Services. We do not use your Content for our own purposes. Where a law requires us to process personal data other than on your instructions, we tell you before we do so, unless that law forbids us to tell you. If we consider that an instruction infringes applicable data protection law, we tell you.

5. Confidentiality

Everyone who has access to your personal data is bound by confidentiality obligations. Access is limited to the personnel who need it to provide the Services. We access your Content only to provide the Services, to investigate an issue you report, to meet a legal obligation, or to deal with a security incident or abuse of the Services.

6. Security

We maintain the technical and organizational measures described on the Security page, which form Annex II. They include TLS in transit, DANE, MTA-STS and TLS reporting for mail between servers, optional encryption at rest with an OpenPGP key or an S/MIME certificate that the account holder registers, access controls, authentication, logging and encrypted backups. The private key for encryption at rest stays with the account holder and is never held on our systems. We keep the measures under review and improve them over time, and we will not reduce the overall level of protection during the term of this DPA. Our commitments on a personal data breach are in section 10.

7. Subprocessors

7.1 Authorization

You give general written authorization for us to engage the subprocessors listed on the Subprocessors page, which forms Annex III. Each subprocessor is bound by a written contract that imposes data protection obligations at least as protective as this DPA, and we remain liable to you for the performance of our subprocessors.

7.2 Adding or replacing a subprocessor

We give at least 30 days notice by email before we add or replace a subprocessor that handles your personal data, and we update the Subprocessors page on the same day. If you object on reasonable data protection grounds within that period and we cannot offer an alternative, you may cancel the affected Service and receive a prorated refund of prepaid fees for the unused part of the term, consistent with section 9.4 of the Terms of Service.

8. International transfers

Where you choose the European Union region, your Content is stored and processed in the European Union. Where you choose the United States region, or where our personnel or a subprocessor access European Union region data from outside it, and personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer is covered by the Standard Contractual Clauses approved by the European Commission, which are incorporated into this DPA by reference. Module 2 (controller to processor) applies, and Module 3 (processor to processor) applies where you act as a processor. For transfers subject to the United Kingdom GDPR, the United Kingdom International Data Transfer Addendum is incorporated by reference. As the Standard Contractual Clauses provide by default, they are governed by the law of Ireland, and the courts of Ireland have jurisdiction.

9. Assistance

Taking account of the nature of the processing, we assist you with a request from a data subject and with a data protection impact assessment or a prior consultation with a supervisory authority. Where that assistance is more than minimal, we provide it at your reasonable cost. If a data subject contacts us directly about your data, we refer the request to you and do not answer it on your behalf.

10. Personal data breaches

If we become aware of a personal data breach that affects your personal data, we notify you without undue delay and no later than 72 hours after we become aware of it. Our notification describes the nature of the breach, the categories and the approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose to take. We provide the information in stages as it becomes available, and we cooperate with you and with any supervisory authority.

11. Audits

Once in any 12 month period, we answer your reasonable written security questionnaire. If that is not enough to demonstrate that we meet Article 28 of the GDPR, you, or an independent auditor you mandate, may audit us once in any 12 month period, including after a personal data breach or a request from a supervisory authority. Give us at least 30 days written notice, agree the scope with us in advance, keep the findings confidential, and bear the cost of the audit. An audit must not give you access to the personal data of another customer.

12. Return and deletion

12.1 Products

A Product account remains readable and exportable for 30 days after a cancellation or a refund, and is then deleted, as described in section 12 of the Terms of Service. Backups of the Products are deleted on the schedule stated on the Security page.

12.2 Sysplore Cloud

Closing a Sysplore Cloud account is permanent and immediate. Everything on the account, including backups, is deleted at closure.

13. CCPA and CPRA

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), applies, we act as a service provider. We do not sell or share your personal data, we do not retain, use or disclose it outside the direct business relationship between us or for a purpose other than the services we provide, and we do not combine it with data from another source except as the CCPA permits.

14. Liability, precedence and changes

Liability under this DPA is subject to section 30 of the Terms of Service. If this DPA conflicts with the Terms of Service on a matter concerning personal data, this DPA prevails. We may update this DPA, and we communicate a material change by email at least 30 days before it takes effect.

15. Contact

For questions about this DPA, or to request a countersigned copy:

Email: [email protected]

Post: Sysplore LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States

Annex I: Details of processing

• Subject matter. The provision of the Services to you.
• Duration. The subscription term, plus the retention windows in section 12.
• Data region. The European Union or the United States, as selected at sign up.
• Nature and purpose. Hosting, storage, transmission, backup and support, to provide the Service you subscribed to and configured.
• Personal data. Identifiers and contact details of your End Users; account data; and the Content you store, which may include message content, files, calendar entries and the data of third parties named in it.
• Data subjects. Your End Users; the people who appear in your Content; and your own customers where you act as their processor.
• Sensitive data. None is requested. You decide what you store in the Service.

Annex II: Security measures

The technical and organizational measures are described on the Security page.

Annex III: Subprocessors

The authorized subprocessors are listed on the Subprocessors page.