Data Processing Agreement (DPA)

1. Parties and background

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions ("Main Agreement") between the parties below. Notwithstanding the governing-law clause of the Main Agreement, this DPA is governed by the law set out in §13. The parties are:

• the customer identified in the Main Agreement (the "Customer", acting as controller); and

• Celdon AG, Bahnhofplatz, 6300 Zug, Switzerland (the "Processor", "we", "us").

It applies where, in using the Celdon Service, the Customer provides personal data that we process on the Customer's behalf — in particular the personal data contained in the files the Customer uploads and the inputs the Customer submits to the assistant ("Customer Personal Data"). Where the Main Agreement and this DPA conflict on data protection matters, this DPA prevails.

Terms such as "controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meanings given in the EU General Data Protection Regulation (GDPR).

2. Subject matter and scope

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1. We process Customer Personal Data only as a processor, to provide the Service.

3. Instructions

We process Customer Personal Data only on the Customer's documented instructions, including on international transfers, unless required to act otherwise by EU or Member State law — in which case we will inform the Customer first, unless the law prohibits it. The Main Agreement, this DPA, and the Customer's configuration and use of the Service constitute the Customer's complete documented instructions. We will inform the Customer if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

We ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and process it only as needed to provide the Service.

5. Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR. Our current measures are described in Annex 2. We may update them over time provided the level of protection is not reduced.

6. Sub-processors

The Customer gives general authorisation for us to engage the sub-processors listed in Annex 1 to process Customer Personal Data. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable for their performance. We will give the Customer advance notice of any intended addition or replacement of a sub-processor, giving the Customer a reasonable opportunity to object on reasonable data protection grounds. If the Customer raises such an objection and we cannot provide an alternative that resolves it within a reasonable time, the Customer may, as its sole remedy, terminate the affected part of the Service by written notice.

7. International transfers

Customer Personal Data is processed within the European Union (our infrastructure runs in AWS EU regions; AWS Bedrock may use EU cross-region inference across several EU data centres). We are established in Switzerland, which the European Commission recognises as providing an adequate level of data protection, so our access to Customer Personal Data from Switzerland does not require additional transfer safeguards. We do not route Customer Personal Data through our global content-delivery network (CloudFront), which serves only the static front-end. We will not transfer Customer Personal Data to any other country outside the EU/EEA except on the Customer's instructions or as needed to provide the Service, and only where an appropriate safeguard under Chapter V GDPR (such as an adequacy decision or the Standard Contractual Clauses) is in place.

8. Assistance to the Customer

Taking into account the nature of the processing and the information available to us, we will assist the Customer by appropriate technical and organisational measures, insofar as possible, with:

• responding to requests from data subjects exercising their rights under the GDPR; and

• the Customer's obligations under Art. 32–36 GDPR (security, breach notification, and data protection impact assessments and prior consultation).

9. Personal data breach

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will, to the extent available, describe the nature of the breach (including the categories and approximate number of data subjects and records affected), the likely consequences, the measures taken or proposed in response, and a contact point for more information (consistent with Art. 33(3) GDPR). We will provide further information as it becomes available and assist the Customer in meeting its own notification obligations.

10. Deletion or return

On termination of the Service, and at the Customer's choice, we will delete or return all Customer Personal Data and delete existing copies, unless EU or Member State law requires us to retain it.

11. Audits

We will make available to the Customer the information reasonably necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits.

12. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Main Agreement. This DPA takes effect on the effective date above and remains in force for as long as we process Customer Personal Data.

13. Governing law

This DPA is governed by the laws of Germany and the GDPR. (Art. 28(3) GDPR requires the processing contract to be governed by Union or Member State law; an EU Member State law is therefore used here, even though the Main Agreement is governed by Swiss law.)

13.1 Swiss customers

Where the Customer is subject to the Swiss Federal Act on Data Protection (FADP), this DPA applies with the equivalent FADP concepts in place of the corresponding GDPR terms, and references to supervisory authorities include the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Annex 1 — Details of the processing

• Subject matter: processing of personal data contained in Customer content in order to provide the Celdon Service.

• Duration: for the term of the Main Agreement, plus any legally required retention period.

• Nature and purpose: storage, organisation, analysis, extraction, and AI-assisted generation of finance-related outputs, as directed by the Customer through its use of the Service.

• Types of personal data: any personal data the Customer includes in uploaded files or assistant inputs — typically identifying and contact details and financial/transactional information relating to the Customer's personnel, clients, suppliers, or counterparties — together with the account details of the Customer's authorised users. The Customer controls what it submits and should not upload special categories of personal data unless necessary.

• Categories of data subjects: the Customer's authorised users; and individuals appearing in the Customer's content (such as its employees, customers, suppliers, and other counterparties).

Approved sub-processors:

(Stripe is not a sub-processor under this DPA: it processes billing data for which Celdon is the controller — described in the Privacy Policy — not Customer Personal Data processed on the Customer's behalf.)

Annex 2 — Technical and organisational measures (TOMs)

We implement the following technical and organisational measures in accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

1. Confidentiality

Physical access control. Production systems and data are hosted in data centres operated by Amazon Web Services in EU regions (primary region Frankfurt). Physical security is provided by AWS under its certified controls (e.g. ISO 27001, SOC 2); we do not operate our own data-centre hardware.

System access control. Access to production systems requires individual, named accounts with strong authentication. End-user access to the Service is controlled by authenticated sessions (short-lived tokens).

Data access control. Access to personal data follows least-privilege and need-to-know principles, granted by role and reviewed periodically. Administrative access is limited to a small number of authorised personnel.

Separation control. Customer data is logically separated within the application and database. Development, staging, and production environments are separated, and production personal data is not used in development or testing.

2. Integrity

Transmission control. All data in transit is encrypted using TLS (HTTPS) over public networks. Data at rest — including the PostgreSQL database and file storage (Amazon S3) — is encrypted using AWS-managed encryption.

Input control. System and application logs record relevant actions and access to support traceability and investigation.

3. Availability and resilience

Resilience. The Service runs on managed, redundant AWS infrastructure designed for high availability. Capacity and availability are monitored, with alerting on anomalies.

4. Procedures for regular review and governance

Incident and breach management. We maintain an incident-response process and will notify affected controllers of a personal data breach without undue delay, as set out in §9 of this DPA.

Vulnerability and change management. We keep software dependencies up to date and address identified vulnerabilities on a risk-prioritised basis. Changes to production are managed through version control and review.

Sub-processor management. Sub-processors are subject to due diligence and bound by data processing agreements with obligations no less protective than those in this DPA (see §6 and Annex 1).

Personnel. Staff with access to personal data are bound by confidentiality obligations and receive data protection and security guidance.

Testing and review. The effectiveness of these measures is reviewed periodically and after significant changes.