DATA PROCESSING AGREEMENT (DPA)
Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018
This Data Processing Agreement ("Agreement" or "DPA") is entered into as of October 26, 2026 (the "Effective Date"), by and between:
DATA CONTROLLER: Acme Enterprise Corp, with offices at 500 Market St, Wilmington, DE 19801 ("Controller"), and
DATA PROCESSOR: CloudMatrix Systems Ltd, with offices at 24 Holborn Viaduct, London EC1A 2BN, UK ("Processor").
The Controller and Processor may individually be referred to as a "Party" and collectively as the "Parties".
1. Purpose & Scope of Processing
This DPA governs the Processing of Personal Data in connection with the Master Services Agreement between the Parties. The Processor shall process Personal Data solely on documented instructions from the Controller, including with regard to transfers of Personal Data outside the EEA or UK, unless required to do so by applicable statutory law.
2. Processor Obligations
The Processor agrees and warrants that it shall:
- Ensure that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Implement and maintain appropriate technical and organizational measures (TOMs) as detailed in Section 5 below to ensure a level of security appropriate to the risk.
- Notify the Controller without undue delay, and in any event within 48 Hours, after becoming aware of any accidental, unauthorized, or unlawful Personal Data Breach.
- Reasonably assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to Data Subject requests under Chapter III of the GDPR.
- At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless applicable law requires storage.
3. Sub-Processors
The Controller hereby grants general written authorization to the Processor to engage sub-processors to carry out specific processing activities. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other sub-processors at least 30 Calendar Days in advance, thereby giving the Controller the opportunity to object to such changes.
4. International Data Transfers
Where Personal Data is transferred outside the European Economic Area (EEA) or the United Kingdom to a country not recognized as providing an adequate level of data protection, the Parties hereby agree to execute and incorporate the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum.
5. Technical & Organizational Measures (TOMs)
The Processor shall maintain the following minimum technical and organizational security controls:
6. Processing Details (Annex I)
Subject Matter & Scope: Provision of cloud software infrastructure.
Categories of Data Subjects: Controller's customers and end users.
Types of Personal Data: Names, emails, IP addresses, logs.
FOR DATA CONTROLLER:
Authorized Signature
Name: Acme Enterprise Corp
Title: Authorized Officer
Date: October 26, 2026
FOR DATA PROCESSOR:
Authorized Signature
Name: CloudMatrix Systems Ltd
Title: Chief Privacy / Legal Officer
Date: October 26, 2026