Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Sustainly s.r.o. and the customer ("Customer") and applies automatically to all Customers without separate signature. It reflects Art. 28(3) GDPR.

Processor: Sustainly s.r.o., IČO 21802106, Dlouhá 3403/2b, 702 00 Ostrava, Czech Republic. Controller: the Customer.

Where this DPA conflicts with the Terms of Service in relation to the processing of personal data, this DPA prevails.

1. Roles

The Customer is the controller of personal data contained in material uploaded to the platform and determines the purposes and means of its processing. Sustainly is the processor and processes that data only on the Customer's behalf.

Sustainly acts as controller in respect of account, billing and website data, as described in the Privacy Policy. That processing is outside this DPA.

2. Scope and Instructions

Sustainly processes personal data only on the Customer's documented instructions, including as to international transfers, unless required otherwise by EU or Czech law — in which case Sustainly will inform the Customer before processing, unless that law prohibits such notice on important grounds of public interest.

The Terms of Service, this DPA, and the Customer's use of the platform's features constitute the Customer's complete documented instructions. Details of the processing are in Annex 1.

Sustainly will inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

3. Customer Obligations

The Customer warrants that it has a lawful basis for the processing it instructs, has provided all required information to data subjects, and that its instructions comply with applicable law. The Customer is responsible for the accuracy and lawfulness of the data it uploads.

The Customer must not upload special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). Where the Customer uploads payroll, HR or similar records, it must redact or remove such data beforehand. Sustainly has no obligation to screen uploads and accepts no liability arising from data uploaded in breach of this clause.

4. Confidentiality

Sustainly ensures that persons authorised to process personal data are bound by an appropriate contractual or statutory duty of confidentiality, and that access is limited to those who need it to perform their duties.

5. Security

Sustainly implements the technical and organisational measures set out in Annex 2, appropriate to the risk under Art. 32 GDPR. Sustainly may update these measures provided the level of protection is not reduced.

6. Sub-processors

The Customer grants general written authorisation for Sustainly to engage sub-processors. The current list is published at /en/subprocessors and reproduced at Annex 3.

Sustainly will give at least 30 days' notice before adding or replacing a sub-processor, by email to the Customer's registered contact or by notice on the sub-processor page where the Customer has subscribed to updates. The Customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith; if no resolution is reached, the Customer may terminate the affected services without penalty, with a pro-rata refund of any prepaid fees for services not yet delivered.

Sustainly imposes on each sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

7. Artificial Intelligence Sub-processors

Sustainly uses AI services to extract, classify and structure information from uploaded documents. In respect of those services:

• content submitted for processing is not used to train the provider's models;
• processing is on a zero-retention or short-retention basis for abuse monitoring only, as specified per provider in Annex 3;
• EU-based processing is selected where the provider offers it;
• no automated decision-making producing legal or similarly significant effects on data subjects is performed;
• outputs are AI-assisted and subject to the Customer's own review, as set out in the Terms of Service.

8. Assistance to the Controller

Taking into account the nature of the processing, Sustainly will assist the Customer by appropriate technical and organisational measures, insofar as possible, in:

• responding to data subject requests under Chapter III GDPR. Where Sustainly receives such a request directly, it will not respond on the merits but will refer the data subject to the Customer and inform the Customer without undue delay;
• complying with Art. 32 to 36 GDPR, including security of processing, breach notification, data protection impact assessments and prior consultation.

Assistance beyond what is reasonably required, or arising from the Customer's own failure to configure the service appropriately, may be charged at Sustainly's standard rates on prior notice.

9. Personal Data Breach

Sustainly will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where full information is not immediately available, it will be provided in phases without undue further delay.

Sustainly will not notify supervisory authorities or data subjects on the Customer's behalf unless the Customer instructs it in writing.

10. Return and Deletion

On termination of the services, the Customer may export its data and generated reports for 30 days. After that period, Sustainly will delete all personal data processed on the Customer's behalf, including from backups in accordance with its backup rotation cycle, within 90 days of termination, unless EU or Czech law requires continued storage. Sustainly will confirm deletion in writing on request.

11. Audit

Sustainly will make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

In the first instance Sustainly will respond to reasonable written information requests and provide its current security documentation. Where that is insufficient, an on-site audit may be conducted no more than once per year, on 30 days' written notice, during business hours, without unreasonable disruption, subject to confidentiality undertakings, and at the Customer's cost — except where the audit reveals material non-compliance, in which case Sustainly bears the reasonable cost. Additional audits may be conducted following a personal data breach or where required by a supervisory authority.

12. International Transfers

Personal data is processed and stored within the European Union. Sustainly will not transfer personal data outside the EEA without the Customer's authorisation and without a valid transfer mechanism under Chapter V GDPR — an adequacy decision under Art. 45, or Standard Contractual Clauses under Art. 46 together with a transfer impact assessment and any supplementary measures required. Any such transfer will be disclosed in Annex 3.

13. Liability and Term

Liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. Nothing in this DPA limits either party's liability to data subjects or to supervisory authorities under Art. 82 or 83 GDPR.

This DPA takes effect when the Customer first uses the platform and continues for as long as Sustainly processes personal data on the Customer's behalf. Clauses 4, 10, 11 and 13 survive termination.

Annex 1 — Description of Processing

Subject matter: provision of the Sustainly platform for ESG reporting, corporate and product carbon footprint calculation, and climate risk assessment.

Duration: for the term of the Terms of Service, plus the deletion periods in clause 10.

Nature and purpose: collection, structuring, storage, extraction, analysis, calculation, report generation, and deletion of information contained in documents uploaded by the Customer, for the purpose of producing the outputs the Customer has ordered.

Types of personal data: personal data incidentally contained in uploaded business records. Typically: names, job titles and work contact details of employees, signatories and supplier contacts appearing on invoices, contracts, energy bills, payroll summaries and financial records; and identifiers such as employee numbers. The Customer determines what it uploads and is instructed not to upload special categories of personal data.

Categories of data subjects: the Customer's employees and contractors; employees and representatives of the Customer's suppliers, customers and business partners.

Frequency: continuous, for the duration of the services.

Annex 2 — Technical and Organisational Measures

Access control. Role-based access; least-privilege administrative access; individual named accounts with no shared credentials; multi-factor authentication on administrative and infrastructure accounts; access reviewed on role change and revoked on departure.

Encryption. TLS 1.2 or higher for all data in transit; encryption at rest for stored data and backups; passwords stored using a modern salted hashing algorithm.

Segregation. Logical separation of Customer data; separation of production from development and test environments; no production personal data used in testing.

Availability and resilience. Regular automated backups with defined retention; documented restore procedure and periodic restore testing; EU-based hosting infrastructure.

Logging and monitoring. Application and access logging; retention of security logs for 12 months; monitoring for anomalous access.

Vulnerability management. Timely patching of infrastructure and dependencies; dependency vulnerability scanning; change management for production releases.

Organisational. Confidentiality undertakings for all personnel with data access; data protection awareness training; documented incident response procedure including internal escalation and Customer notification; written data protection agreements with all sub-processors; record of processing activities maintained under Art. 30(2) GDPR.

Deletion. Documented procedure for deletion and return of Customer data on termination, covering backups.