Data Processing Agreement

Published: October 28, 2026. This DPA becomes part of an agreement when incorporated and accepted under the Terms of Service or an express written agreement. Publication does not backdate acceptance or replace a separately executed DPA contrary to its terms.

1. Scope and roles

This Data Processing Agreement (DPA) is between the Customer identified in the applicable agreement and Topolo Technology Inc., 16958 Coastal Highway, Lewes, Delaware, 19952, United States (Topolo). It applies to personal data Topolo processes on the Customer's behalf through the agreed services, including expressly ordered implementation and support (Customer Personal Data).

The Customer acts as controller or as a processor for its controller; Topolo acts as processor or subprocessor accordingly. The Customer must have its controller's authorisation where required. Topolo's separate processing for account administration, billing, business communications and its own lawful security or legal purposes is described in the Privacy Policy; that does not authorise independent reuse of customer-controlled content.

Data Protection Laws means the privacy and data-protection laws applicable to the relevant processing, including the EU GDPR, UK GDPR and applicable US state privacy laws. Controller, processor, personal data, processing and personal data breach have their meanings under the applicable law.

2. Customer responsibilities and instructions

The Customer is responsible for lawful collection and use, required notices and permissions, marketing compliance, accuracy, minimisation, retention choices, recipient selection and its instructions. It must have the right to transfer or provide access to the data, and assess whether the standard service meets its requirements.

The agreement, accepted scope, supported settings and authorised written requests are the documented instructions. Topolo will process Customer Personal Data only to provide, secure and support the agreed services in accordance with those instructions, including instructions about transfers, unless processing is required by applicable law. Where legally permitted, Topolo will notify the Customer of such a requirement before processing and promptly inform it if an instruction appears to infringe Data Protection Laws.

Instructions outside the agreed service require a separate written scope and may involve additional fees. It must still fulfil applicable mandatory duties. If an instruction cannot lawfully be performed, Topolo may suspend affected processing while the parties seek a lawful resolution. No instruction permits selling Customer Personal Data, unrelated advertising or general-purpose model training for Topolo's own purposes.

3. Personnel and security

Topolo will restrict authorised access to personnel and systems that need it for the agreed services and ensure persons authorised to process the data are bound by confidentiality. Topolo will implement appropriate technical and organisational measures under applicable law, taking account of the processing, risks, available technology and implementation costs. The measures are described in Annex II and our security information. Changes must not materially reduce the overall protection or required safeguards.

4. Subprocessors

The Customer gives general written authorisation for the applicable providers in our subprocessor list. Only providers needed for the services or features used receive the relevant data. Topolo will impose the applicable data-protection obligations on its subprocessors and remains responsible for their performance as required by Data Protection Laws.

Topolo will notify the Customer through its service contact details of an intended material addition or replacement at least 30 days before the new subprocessor processes Customer Personal Data, where practicable. The Customer may object within 15 days on reasonable, specific data-protection grounds. For an urgent replacement needed to protect security or continuity, notice will be given as soon as practicable, with a meaningful opportunity to raise concerns; any mandatory longer notice requirement prevails.

The parties will seek a commercially reasonable resolution. If no reasonable alternative resolves the objection, the Customer may terminate the affected service before the disputed new processing in accordance with the agreement and applicable law. Mandatory transfer-clause rights remain unaffected.

5. Rights requests and assistance

Taking account of the nature of processing, Topolo will provide appropriate technical and organisational assistance to help the Customer respond to individuals' requests. Requests about customer-controlled information will ordinarily be directed or notified to the Customer; Topolo will not independently determine the response except as instructed or legally required.

Taking account of the processing and information available, Topolo will assist with security, breach notification, required impact assessments and regulator consultations. The Customer remains responsible for its legal assessment and decisions. Topolo may charge reasonable agreed fees for exceptional bespoke assistance where lawful, but may not withhold timely mandatory cooperation pending a fee dispute. Correcting Topolo's own breach does not attract an additional assistance fee.

6. Personal data breaches

Topolo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will supply available information about the nature of the breach, affected categories and approximate numbers where known, likely consequences, mitigation and a contact point, and provide updates as further information becomes available. Topolo will take appropriate containment and remedial steps and reasonably cooperate with the Customer. Notification is not an admission of fault. Unsuccessful attempts without a personal data breach are not automatically reportable under this provision.

7. Demonstrating compliance

Topolo will make available information necessary to demonstrate compliance with applicable processor obligations and allow and contribute to legally required audits and inspections by the Customer or its mandated auditor. Existing documentation and available assurance information should be used first where sufficient. Routine requests should be consolidated, normally no more than annually, with reasonable notice, confidentiality and security restrictions and reasonable agreed costs where lawful.

These procedures do not restrict urgent or additional review required by law, a regulator, a material incident or reasonable evidence of non-compliance. Audit arrangements must protect other customers, privileged information, credentials and service continuity; secure alternatives should be used where appropriate. Charges and confidentiality requirements must not defeat mandatory rights. Intrusive testing requires separate written authorisation and an agreed scope.

8. Return and deletion

At the Customer's choice, after the relevant processing ends Topolo will return or delete Customer Personal Data and delete copies, unless applicable law requires retention. Use supported export and deletion functions where available, or contact privacy@topolo.io. Return will use a reasonably usable supported format; bespoke migration and conversion are separate from legally required return.

Topolo will complete deletion without undue delay in light of the relevant service, legal requirements and technically necessary deletion cycles. Backup copies awaiting scheduled expiry must be protected and put beyond ordinary use, and deleted on the applicable cycle; if restored, applicable deletion instructions must be reapplied. Any legally required retention must be limited to that purpose and remain protected. No indefinite archive or universal immediate backup purge is promised. A specific retention or deletion period applies only where expressly stated for the relevant service or agreed in writing.

9. International processing

Topolo is a US provider using international infrastructure and support. The Customer instructs the international processing necessary for the agreed service, subject to this DPA and valid safeguards.

Each party must satisfy its applicable transfer obligations, including required assessments and supplementary measures. Topolo will provide reasonably available relevant information to assist the Customer; it does not assume the Customer's legal assessment of its business. The clauses in Annex III apply where a covered restricted transfer requires them and the relevant instrument is legally applicable.

10. US service-provider provisions

Where applicable US state privacy law requires Topolo to act as a service provider, contractor or processor, it will process Customer Personal Data only for the specified service purposes and permitted uses. It will not sell the data, share it for cross-context behavioural advertising, retain/use/disclose it outside the permitted business relationship, or combine it with other data except as legally permitted. Topolo will provide the legally required level of protection, notify the Customer if it can no longer meet its obligations, and permit reasonable compliance verification and steps to stop and remediate unauthorised use. Required subcontractor restrictions and certifications apply. Neither party authorises a prohibited use by agreeing to these Terms.

11. Contract priority and liability

The agreement's commercial provisions, including confidentiality and aggregate liability limits, apply to this DPA to the extent permitted by law. They do not diminish individuals' mandatory rights, regulatory powers or mandatory transfer-clause obligations. Mandatory transfer clauses prevail over conflicting provisions. The Customer contracting entity coordinates permitted affiliate instructions and routine information requests; this does not restrict non-waivable rights.

Annex I. Processing and transfer details

Data exporter: the Customer legal entity identified in the accepted order or account. Its address, contact person and contact details are those supplied in that order/account and updated by its authorised administrator. Its activities are using the selected services for its own lawful purposes or on its controller's behalf. Its role is controller or processor as applicable. The Customer must provide accurate legal-entity and contact details before relying on the transfer arrangement.

Data importer: Topolo Technology Inc., 16958 Coastal Highway, Lewes, Delaware, 19952, United States. Contact: privacy@topolo.io, Privacy Contact. Activities: providing the contracted platform, hosting and ordered implementation/support. Role: processor, or subprocessor where the Customer is a processor. The parties' authorised acceptance of the agreement containing this DPA constitutes their execution of the incorporated clauses, subject to any required additional execution formalities. The start date is that actual acceptance date, not a backdated publication date.

Individuals: the Customer's authorised users, personnel, business contacts, customers, prospects, suppliers, respondents, attendees and other individuals whose information it lawfully submits through supported features. Only categories actually used apply.

Personal data: identity and contact information, business affiliations, account and access information, form/survey/assessment responses, customer-submitted content, communications and transactional/service metadata necessary for the selected functions. The Customer controls submitted fields and content. Sensitive or specially regulated categories are not generally authorised: only an expressly supported use with required safeguards and legal conditions is permitted under the agreement.

Nature and purposes: collection, recording, organisation, storage, retrieval, instructed analysis and display, transmission to authorised providers and recipients, export and deletion, to deliver and support the selected services.

Frequency and duration: continuously or as initiated by the Customer during the relevant service and required return/deletion period. Retention follows the Customer's instructions, the agreed service and Section 8. Applicable subprocessor processing is limited to its stated function and relevant service period, subject to legally permitted retention.

Competent authority: for eligible EU transfers, the supervisory authority determined by Clause 13 of the SCCs based on the exporter's establishment, representative or relevant individuals; for UK transfers as adapted by the UK Addendum, the Information Commissioner. For Swiss transfers, the competent Swiss authority where required. The applicable authority is determined by the relevant law, not Topolo's Delaware forum clause.

Annex II. Technical and organisational measures

Topolo uses HTTPS for service connections; account, organisation and application permissions to control access; scoped credentials for supported API and agent operations; and access controls for operational support. Its primary Cloudflare infrastructure supplies the underlying managed storage and network protections for the services used.

Measures include separation of production and testing environments, restricted operational access, confidentiality duties, operational/security logging, credential handling, incident investigation and response, and processes to assess and address vulnerabilities. Topolo will maintain measures appropriate to confidentiality, integrity, availability and resilience, restoration needs, and regular assessment of effectiveness as required by applicable law. Service-specific restoration, deletion and provider safeguards apply to the relevant stores and features.

The Customer manages its own access grants, instructions, notices, minimisation, supported settings and export needs. These responsibilities do not remove Topolo's own obligations. Topolo may update measures without materially reducing overall protection. Reasonably available further information needed for a lawful assessment may be requested under Section 7.

Annex III. Standard contractual clauses and UK Addendum

For an eligible restricted transfer requiring contractual safeguards, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 are incorporated in full, subject to the selections and completed information below. They apply only to the extent the instrument can lawfully cover the relevant transfer. If a different valid instrument is legally required, the parties must put it in place before relying on that transfer. This agreement does not alter the clauses beyond permitted selections and adaptations.

Modules and options: Module Two applies where the Customer is controller and Topolo processor; Module Three applies where the Customer is processor and Topolo subprocessor. Module One does not apply merely because Topolo separately processes its own account information. Clause 7 docking is included. Clause 9 uses Option 2, general written authorisation, with 30 days' advance notice of intended subprocessor additions/replacements; mandatory clause requirements prevail over any inconsistent emergency exception elsewhere in this DPA. The optional independent dispute-resolution language in Clause 11 is not included. Clause 17 uses Option 1 and Irish law; Clause 18 designates the courts of Ireland, without limiting individuals' rights under those clauses.

Appendices: SCC Annex I A and B are completed by Annex I of this DPA, including the actual accepted Customer order/account details. SCC Annex I C is completed by the competent-authority provision above using the rule in Clause 13. SCC Annex II is completed by Annex II of this DPA and the linked security measures. The applicable subprocessor list is incorporated for the functions used. Under the general-authorisation option, an additional specific-authorisation Annex III is not required. Data subjects may obtain relevant safeguards through privacy@topolo.io, subject to lawful redaction.

UK transfers: the approved International Data Transfer Addendum, template B.1.0 issued by the ICO and laid before Parliament on 2 February 2022, is incorporated using its approved incorporation method. Table 1 is completed by the parties, contacts, actual acceptance and start information in Annex I. Table 2 selects the 2021/914 SCCs and the modules/options just specified. Table 3 is completed by Annexes I and II and the applicable subprocessor information. Table 4 selects neither party as entitled to end the Addendum solely under its Section 19. The SCCs are modified only as required by the approved Addendum.

Part 2 incorporation: Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

The ICO's approved text and incorporation guidance identify the mandatory clauses incorporated here. The Addendum prevails over conflicting SCC provisions as it requires. Mandatory transfer provisions prevail over the Terms' law, forum, liability and audit restrictions to the extent of conflict.

Swiss transfers: where the SCCs are used for data protected by Swiss law, references are read to include the relevant Swiss law, authority and protected individuals as needed to provide the required safeguards without diminishing GDPR protections where both apply. No adequacy or certification status is asserted without the applicable legal conditions being met.