Data Processing Agreement (DPA)

1.1. The terms "Personal Data", "Processing", "Data Subject", "Controller", "Processor", "Sub-processor", "Personal Data Breach", "Special Categories of Personal Data" and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.

1.2. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

1.3. "SCCs" means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.4. "Services" means the cybersecurity threat analysis, incident response and related services provided by Cyberangels to the Customer pursuant to the MSA.

1.5. "Sub-processor" means any third party engaged by Cyberangels to Process Personal Data on its behalf in connection with the provision of the Services.

1.6. "TOMs" means the Technical and Organizational Measures set out in Annex II.

1.7. "AI Systems" has the meaning given in Section 13.1.

1.8. In case of any conflict between this DPA and the MSA on matters of data protection, this DPA prevails.

2.1. Modular scope. This DPA applies in two configurations, as identified in Annex IV (Configuration) and / or in the relevant Order Form:

• Module A — Direct Customer. The Customer is the data Controller in respect of the Personal Data transmitted to or generated by the Services for its own internal use. Cyberangels acts as Processor for the Customer.
• Module B — Channel Partner. The Customer acts as a Channel Partner under the Cyberangels Channel Partner Agreement (CPA), making the Services available to its own end customers ("End Customers"). The End Customer is the ultimate Controller; the Customer (Channel Partner) acts as Processor in respect of the End Customer; Cyberangels acts as Sub-processor in respect of the End Customer (and as Processor in the bilateral relationship with the Customer for the purpose of the obligations of this DPA). The additional terms in Section 19 (Channel Partner / B2B2B Configurations) apply.

If the Configuration is not specified in Annex IV or the Order Form, Module A applies by default.

2.2. Cyberangels shall Process Personal Data only on documented instructions from the Customer (and, in Module B, ultimately from the End Customer through the Customer), including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which Cyberangels is subject; in such a case, Cyberangels shall inform the Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.

2.3. Cyberangels shall immediately inform the Customer if, in its opinion, an instruction issued by the Customer (or, in Module B, by an End Customer through the Customer) infringes the GDPR or other applicable data protection provisions.

2.4. Cyberangels shall maintain a record of Processing activities carried out on behalf of the Customer pursuant to Article 30(2) GDPR and shall make it available to the Customer or the competent Supervisory Authority on request.

The full description of the Processing is set out in Annex I. In summary:

• Subject-matter of Processing: the provision of cybersecurity threat analysis and incident response services.
• Duration of Processing: for the term of the MSA and any post-termination period required for return or deletion of Personal Data.
• Nature and purpose of Processing: to analyze security logs, user activity and other relevant data to identify, manage and report on cybersecurity threats as part of the Services.
• Types of Personal Data: user account data (names, email addresses, role), IP and MAC addresses, system and security logs, authentication events, and other data voluntarily uploaded by the Controller.
• Categories of Data Subjects: Customer's employees, authorized users and contractors.

3.1. Exclusion of Special Categories. The Parties acknowledge that the Services are not designed or intended to Process Special Categories of Personal Data (Article 9 GDPR) or Personal Data relating to criminal convictions and offences (Article 10 GDPR). The Customer shall not upload or transmit such categories of data to the Services without a prior written addendum to this DPA.

4.1. Cyberangels shall implement and maintain the technical and organizational measures set out in Annex II to ensure a level of security appropriate to the risk pursuant to Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing and the risks for the rights and freedoms of natural persons.

4.2. Cyberangels holds and maintains the following certifications, which evidence the design and operation of its Information Security Management System: ISO/IEC 27001 and ISO 9001. Cyberangels shall promptly notify the Customer of any material change in the scope or status of such certifications.

4.3. Cyberangels may update the TOMs from time to time provided that any update does not materially decrease the overall level of protection of Personal Data.

5.1. The Customer hereby provides Cyberangels with a general written authorization to engage Sub-processors for the purpose of providing the Services, subject to the conditions set out in this Section 5.

5.2. Cyberangels maintains an up-to-date list of Sub-processors, including their name, location, processing role and category of data processed. The list is treated as confidential and is made available to the Customer upon written request and subject to a non-disclosure undertaking, in accordance with Section 8.

5.3. Cyberangels shall notify the Customer of any intended addition or replacement of Sub-processors at least thirty (30) days before such Sub-processor begins Processing Personal Data. The Customer shall have the right to object to such change on reasonable data-protection grounds within fifteen (15) days of the notice. If the Parties cannot agree on a remediation within a further fifteen (15) days, the Customer may terminate the affected portion of the Services without penalty.

5.4. Cyberangels shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those set out in this DPA (including, where applicable, the SCCs as referenced in Section 7), in accordance with Article 28(4) GDPR.

5.5. Cyberangels shall remain fully liable to the Customer for the performance of each Sub-processor's data protection obligations.

6.1. Taking into account the nature of the Processing, Cyberangels shall assist the Customer by appropriate technical and organizational measures, insofar as possible, in the fulfilment of the Customer's obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

6.2. Cyberangels shall, to the extent legally permitted, notify the Customer without undue delay and in any event within five (5) business days if it receives a request from a Data Subject. Cyberangels shall not respond to such request itself, unless authorized by the Customer or required by law.

7.1. Cyberangels Processes Personal Data primarily within the European Economic Area ("EEA").

7.2. Where Cyberangels engages Sub-processors located outside the EEA in countries that are not covered by an adequacy decision of the European Commission, Cyberangels shall ensure that the transfer is governed by the SCCs (Module Three — Processor to Processor) pursuant to Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and shall be deemed executed between Cyberangels and the relevant Sub-processor on behalf of, and for the benefit of, the Customer.

7.3. Cyberangels shall conduct and document a Transfer Impact Assessment ("TIA") for each such transfer, in accordance with EDPB Recommendations 01/2020, and shall make the TIA available to the Customer upon reasonable written request.

7.4. Where the Customer itself is established outside the EEA, the Parties shall agree on the applicable SCC module and execute the relevant clauses as a separate addendum to this DPA.

8.1. Cyberangels shall ensure that personnel authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have received appropriate training on data protection.

8.2. Information exchanged under this DPA — including, without limitation, the Sub-processor list (Section 5.2), the TIA (Section 7.3), TOM details (Annex II) and audit findings (Section 9) — is confidential and shall be used by the receiving Party solely for the purpose of performing or enforcing this DPA.

9.1. Cyberangels shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or another independent auditor mandated by the Customer.

9.2. Documentary audit. The Customer's audit obligations under Article 28(3)(h) GDPR shall be deemed satisfied when Cyberangels provides, upon request, copies of the most recent third-party audit reports and certifications referenced in Section 4.2 (including ISO/IEC 27001 statement of applicability and audit summary), unless the Customer can reasonably demonstrate that such reports are insufficient to verify compliance with a specific obligation.

9.3. On-site audit. Where a documentary audit is insufficient, the Customer may conduct an on-site audit subject to the following conditions: (i) the Customer shall provide at least thirty (30) days' prior written notice; (ii) the audit shall be conducted during Cyberangels' normal business hours and in a manner that does not unreasonably disrupt operations; (iii) audits shall be limited to one (1) per calendar year, except where required by a confirmed Personal Data Breach or by a Supervisory Authority; (iv) the auditor shall not be a competitor of Cyberangels and shall be bound by appropriate confidentiality undertakings; (v) the Customer shall bear all costs and expenses of the audit, unless the audit reveals a material breach by Cyberangels of this DPA, in which case Cyberangels shall bear its own costs.

9.4. The scope of any audit shall be limited to documents, records and systems necessary to demonstrate Cyberangels' compliance with this DPA. All audit findings are confidential pursuant to Section 8.

10.1. Cyberangels shall notify the Customer without undue delay and in any event within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

10.2. Where the full information required under Section 10.3 is not yet available within the 48-hour window, Cyberangels shall provide a preliminary notification within 48 hours and a complete notification as soon as reasonably possible thereafter, and in any event within seventy-two (72) hours of becoming aware of the Personal Data Breach.

10.3. Each notification shall, at a minimum: (a) describe the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned; (b) provide the name and contact details of the Cyberangels Data Protection Officer or other relevant contact point (see Annex I); (c) describe the likely consequences of the Personal Data Breach; and (d) describe the measures taken or proposed to be taken by Cyberangels to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

10.4. Cyberangels shall cooperate with the Customer and provide reasonable assistance in connection with any required notification to a Supervisory Authority or to affected Data Subjects pursuant to Articles 33 and 34 GDPR.

11.1. Taking into account the nature of the Processing and the information available to Cyberangels, Cyberangels shall provide the Customer with reasonable assistance in ensuring compliance with the Customer's obligations pursuant to Articles 32 to 36 GDPR (Security of Processing, Personal Data Breach notification, communication to Data Subjects, Data Protection Impact Assessment, prior consultation).

11.2. Where such assistance materially exceeds what is reasonably included within the Services, Cyberangels may charge the Customer at its then-current professional services rates, after prior written agreement.

12.1. Upon termination or expiry of the MSA, Cyberangels shall, at the Customer's choice exercised in writing, either return all Personal Data to the Customer in a commonly used machine-readable format or delete it.

12.2. Cyberangels shall complete the return or deletion within thirty (30) days of termination of the MSA, save where Union or Member State law requires storage of the Personal Data, in which case the Personal Data shall be retained only for the period and for the purpose strictly required by such law.

12.3. Upon completion of deletion, Cyberangels shall provide the Customer with a written certificate of deletion signed by an authorized representative.

13.1. Use of AI Systems. The Customer acknowledges that Cyberangels uses proprietary and/or third-party Artificial Intelligence and machine learning systems (collectively, "AI Systems") as an integral and necessary part of the Services to perform the Processing activities described in Section 3, specifically for threat analysis and classification, attack pattern identification, incident management, and the generation of threat intelligence reports. The AI Systems shall always operate under the documented instructions of the Customer pursuant to Section 2.2.

13.2. Security and Compliance. Cyberangels ensures that Personal Data Processed by the AI Systems is subject to the same TOMs and confidentiality obligations defined in this DPA, including when transmitted to or processed by third-party AI providers acting as Sub-processors pursuant to Section 5.

13.3. Transparency. Cyberangels shall maintain documentation of the AI Systems used in the provision of the Services, including the foundation models employed, the providers, the geographical locations of Processing, and the role of human oversight, in compliance with the transparency obligations of Regulation (EU) 2024/1689 (the "EU AI Act"). Such documentation shall be made available to the Customer on reasonable written request.

13.4. Non-Applicability of Solely Automated Decision-Making (Article 22 GDPR). Cyberangels warrants that the Services, including outputs generated by the AI Systems, do not involve decision-making based solely on automated Processing which produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject. All critical outputs or actions suggested by the AI Systems are subject to supervision, validation and human review by qualified Cyberangels personnel before being implemented or resulting in final notifications to the Customer.

13.5. AI Model Training. Unless explicitly agreed otherwise in a written addendum signed by the Parties, Cyberangels shall not use the Customer's Personal Data or content for the training, improvement or creation of AI models intended for use with other customers or the general public. Aggregated and anonymized data, such that it no longer constitutes Personal Data, may be used solely for the purpose of technical improvement of the security and general performance of the Services.

13.6. Sub-processor Flow-down. Cyberangels shall ensure that any third-party AI provider engaged as a Sub-processor is contractually prohibited from using the Customer's Personal Data for training of general-purpose models.

14.1. The Parties acknowledge that the Customer may qualify as an "essential entity" or "important entity" under Directive (EU) 2022/2555 ("NIS2 Directive") and corresponding national implementing law.

14.2. Cyberangels, as a supplier of cybersecurity services, shall provide reasonable cooperation to the Customer in fulfilling its supply chain security obligations under Article 21 NIS2, including by (a) maintaining the certifications referenced in Section 4.2, (b) providing security-related information reasonably required for the Customer's risk assessments, and (c) notifying the Customer of significant incidents affecting the Services in accordance with Section 10.

15.1. Each Party's liability arising out of or in connection with this DPA shall be subject to the liability cap and exclusions set forth in the MSA, save that:

(a) liability for damages caused by Processing in violation of the GDPR shall be allocated between the Parties in accordance with Article 82 GDPR; and

(b) Cyberangels shall maintain in force, throughout the term of the MSA, a cyber liability insurance policy with coverage no less than the amount specified in the MSA (or, where not specified, EUR 2,000,000 per claim). Evidence of such insurance shall be provided to the Customer upon written request.

16.1. This DPA enters into force on the effective date of the MSA and shall continue for as long as Cyberangels Processes Personal Data on behalf of the Customer.

16.2. Sections that by their nature are intended to survive termination — including Sections 8 (Confidentiality), 9 (Audit Rights, in respect of the Processing prior to termination), 12 (Return and Deletion) and 15 (Liability) — shall survive the termination or expiry of this DPA.

17.1. This DPA is governed by and construed in accordance with the laws of the Republic of Italy, without regard to its conflict-of-laws rules.

17.2. The Parties submit to the exclusive jurisdiction of the Court of Milan, Italy for any dispute arising out of or in connection with this DPA, without prejudice to the rights of Data Subjects and Supervisory Authorities under applicable data protection law.

This Section 19 applies only where the Customer acts as a Channel Partner pursuant to the CPA, i.e. where Module B is selected in Annex IV.

19.1. Data-protection chain. The Parties recognize the following chain in respect of Personal Data of End-Customer Data Subjects:

End Customer (Controller) → Customer / Channel Partner (Processor) → Cyberangels (Sub-processor)

The Customer warrants that it has in place, with each End Customer, a written data-processing arrangement consistent with Article 28 GDPR and with this DPA, authorizing the engagement of Cyberangels as a Sub-processor and the further sub-processing chain defined by Cyberangels in accordance with Section 5 of this DPA.

19.2. Flow-down of Controller instructions. The Customer shall pass through to Cyberangels the documented instructions of each End Customer that affect the Processing carried out by Cyberangels. Cyberangels' obligations under this DPA shall be deemed to extend to such instructions, to the extent operationally feasible and consistent with the design of the Services.

19.3. SCCs in the B2B2B chain. Where Personal Data of End-Customer Data Subjects is transferred outside the EEA in the absence of an adequacy decision:

(a) the SCCs Module Three (Processor-to-Processor) apply between the Customer (as Processor of the End Customer) and Cyberangels (as Sub-processor), and are incorporated into this DPA by reference and deemed executed for that purpose;

(b) where Cyberangels engages further Sub-processors outside the EEA, the SCCs Module Three (Processor-to-Processor) apply between Cyberangels and such further Sub-processor, on behalf of and for the benefit of the relevant End Customer, in accordance with Section 7;

(c) the Customer remains responsible for ensuring that the underlying transfer from the End Customer (Controller) to the Customer (Processor) — if outside the EEA — is itself covered by an appropriate transfer mechanism.

19.4. Data Subject rights in the B2B2B chain. Where Cyberangels receives a request from an End-Customer Data Subject, it shall, to the extent legally permitted, redirect the request to the Customer (which shall in turn coordinate with the End Customer) and shall not respond directly to the Data Subject unless instructed in writing by the Customer or required by law.

19.5. Personal Data Breach in the B2B2B chain. A Personal Data Breach affecting End-Customer Personal Data shall be notified by Cyberangels to the Customer in accordance with Section 10. The Customer shall promptly notify the affected End Customer(s) and shall reasonably cooperate with Cyberangels to define the content of any onward notifications. The 48-hour notification window in Section 10.1 runs from Cyberangels' awareness of the breach, irrespective of the position of the relevant Data Subjects in the chain.

19.6. Audit in the B2B2B chain. Where an End Customer requires audit assurances from Cyberangels in connection with the Customer's own Article 28 obligations, the Customer shall consolidate such requests and exercise the audit right under Section 9 of this DPA on behalf of the End Customer; Cyberangels is not required to admit direct audits by End Customers.

19.7. No direct contractual relationship with End Customers. Save as expressly provided in this Section 19, Cyberangels has no direct contractual or data-protection relationship with the End Customers; the Customer remains the sole point of contact for End-Customer matters.

19.8. Liability allocation. Liability for damages caused by Processing in violation of the GDPR shall be allocated in accordance with Article 82 GDPR and the limitations set out in the CPA, taking into account the role of each Party in the B2B2B chain.

20.1. Order of precedence. In case of conflict between (i) this DPA, (ii) the SCCs incorporated by reference in Sections 7 and 19, and (iii) the underlying agreement (MSA for Direct Customers, or CPA for Channel Partners), the order of precedence shall be: SCCs > DPA > underlying agreement, on matters of data protection.

20.2. Severability. If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

20.3. Amendments. Any amendment to this DPA shall be in writing and signed by both Parties.

20.4. Counterparts and electronic signatures. This DPA may be executed in counterparts, each of which shall be deemed an original. Electronic signatures shall be valid and binding.

A. List of Parties

Controller (Data Exporter):

Processor (Data Importer):

B. Description of the Processing

The Technical and Organizational Measures are confidential pursuant to Section 8.2 of this DPA and are made available to the Customer upon written request.

Cyberangels maintains an up-to-date list of Sub-processors engaged in the Processing of Personal Data on behalf of the Customer. The list contains, for each Sub-processor, the corporate name, country of establishment, processing role, category of Personal Data processed and the legal mechanism governing any transfer outside the EEA.

The Sub-processor list is treated as confidential information. It is made available to the Customer upon written request to info@cyberangels.io, subject to a non-disclosure undertaking consistent with Section 8 of this DPA.

Cyberangels will notify the Customer of intended additions or replacements of Sub-processors in accordance with Section 5.3 (and, in Module B, in accordance with Section 19).

This Annex identifies which Module of this DPA applies to the relationship between the Parties.

If neither Module is selected, Module A applies by default, and any subsequent change of Configuration requires a written addendum signed by both Parties.