Version 02 January 2026

DATA PROCESSING AGREEMENT (GDPR)

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions or other service agreement (the "Agreement") between Prodeen ("Processor") and the customer entity identified in the Agreement ("Controller").

This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR") and the Swiss Federal Act on Data Protection (nFADP).

1. Definitions

Capitalized terms not otherwise defined herein shall have the meaning set out in the GDPR and the nFADP. Any references to Supervisory Authorities shall include the Swiss Federal Data Protection and Information Commissioner (FDPIC).

2. Roles of the Parties
3. The Controller determines the purposes and means of the processing of Personal Data.
4. Prodeen processes Personal Data solely on behalf of and under the instructions of the Controller and acts as a Data Processor.

3. Subject Matter and Duration of Processing
4. Subject matter: Provision of the Prodeen platform and related services.
5. Duration: For the term of the Agreement and until deletion or return of Personal Data in accordance with Section 11.

4. Nature and Purpose of Processing

Processing activities may include collection, storage, structuring, consultation, analysis, transmission, and deletion of Personal Data for the purpose of providing the Prodeen services.

5. Categories of Data Subjects and Personal Data

Data Subjects may include:

5. Customer users
6. Supplier contacts
7. Business partners and third parties uploaded by the Controller

Types of Personal Data may include:

8. Names
9. Email addresses
10. Professional contact details
11. Communications shared through the platform (including chat functionalities)

Special categories of personal data are not intended to be processed.

6. Processor Obligations

Prodeen shall:

1. Process Personal Data only on documented instructions from the Controller.
2. Ensure persons authorized to process Personal Data are bound by confidentiality.
3. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
4. Not engage another processor without authorization in accordance with Section 7.
5. The Processor shall process personal data lawfully, in good faith and solely on documented instructions of the Controller and shall implement appropriate technical and organisational measures to ensure full compliance with the applicable laws.

7. Sub-processors
8. The Controller authorizes Prodeen to engage sub-processors as necessary to provide the services.
9. Prodeen shall ensure sub-processors are bound by data protection obligations no less protective than this DPA.
10. Prodeen shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object.

Current authorized sub-processors include:

4. Clerk, Inc. – Authentication and user management (may process user email addresses and identifiers). Data processing governed by Clerk DPA.
5. HubSpot, Inc. – Customer relationship management and communications (may process user contact details). Data processing governed by HubSpot DPA.

An up-to-date list of sub-processors shall be made available upon request.

8. Data Subject Rights

Prodeen shall assist the Controller, insofar as possible, in fulfilling its obligations to respond to requests for exercising data subject rights under the GDPR and nFADP.

9. Personal Data Breach

Prodeen shall notify the Controller within 24 hours after becoming aware of a Personal Data Breach and provide relevant information as required by Article 33 GDPR and the corresponding provison under the nFADP.

10. Audits

Prodeen shall make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits conducted by the Controller or an independent auditor, subject to reasonable notice and confidentiality.

11. Deletion or Return of Personal Data

Upon termination of the Agreement, Prodeen shall, at the choice of the Controller, delete or return all Personal Data, unless EU law requires storage.

12. Data Location and Transfers
13. Primary hosting and processing of Personal Data by Prodeen occurs within the European Union.
14. Certain sub-processors (including Clerk and HubSpot) may process limited categories of Personal Data outside the EU, including in the United States.
15. Where Personal Data is transferred outside the EU, such transfers are conducted in compliance with Chapter V of the GDPR and are subject to appropriate safeguards, including Standard Contractual Clauses or equivalent mechanisms as declared by the relevant sub-processor.
16. Cross-Border Transfers outside of Siwtzerland shall be subject to Swiss-reconised Standard Contractual Clauses and Transfer Impact Assessments where ever required.

13. Liability

Liability arising from data protection obligations shall be governed by the Agreement, subject to mandatory GDPR provisions.

14. Governing Law

This DPA shall be governed by the laws specified in the Agreement, subject to appliacbale provisons of the GDPR and nFADP. Nothing shall limit mandatory provisions under Swiss Law.

ANNEX 1 – Technical and Organizational Measures

Prodeen implements appropriate measures including access controls, encryption in transit, logical segregation, monitoring, and regular security reviews.