Data Processing Agreement

(a) Roles. Customer is the Controller and Stellion OOD is the Processor with respect to Personal Data processed under the Agreement.

(b) Scope. The subject-matter, duration, nature and purpose of Processing, types of Personal Data and categories of Data Subjects are set out in Annex I (Details of Processing).

(a) Security Measures. Taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of Processing as well as the risk to Data Subjects, Stellion OOD shall implement and maintain appropriate technical and organisational measures ("TOMs") to protect Personal Data, including measures set out in Annex II (Security Measures).

(b) Policies & Certifications. On request, and subject to confidentiality obligations, Stellion OOD will provide information reasonably necessary to demonstrate compliance (e.g., summaries of policies, third-party audit reports such as SOC 2/ISO 27001 if available, penetration test summaries).

(a) Authorisation. Customer provides general written authorisation for Stellion OOD to engage Sub-processors. Current categories and an up-to-date Sub-processor list are set out in Annex III.

(b) Notice & Objection. Stellion OOD will provide prior notice of any intended changes concerning the addition or replacement of Sub-processors. Customer may reasonably object in writing within 10 business days of notice. If the Parties cannot reach a mutually acceptable solution, Customer may suspend the affected Processing or terminate the applicable Services (without penalty).

(c) Sub-processor obligations. Stellion OOD shall impose data protection obligations on Sub-processors by written contract that are no less protective than those set out in this DPA. Stellion OOD remains fully liable for the performance of each Sub-processor's obligations.

(a) Data Subject Requests. Taking into account the nature of the Processing, Stellion OOD shall assist Customer by appropriate technical and organisational measures for the fulfilment of Customer's obligations to respond to Data Subject rights requests. If Stellion OOD receives a request directly, it will promptly forward it to Customer.

(b) Security & DPIAs. Stellion OOD shall assist Customer in ensuring compliance with obligations relating to security of Processing, Personal Data Breach notifications, data protection impact assessments, and prior consultations.

(a) Documentation. Upon written request, Stellion OOD will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA.

(b) Audits. No more than once in any 12-month period (unless required by a Supervisory Authority or following a Personal Data Breach), Customer may audit Stellion OOD's compliance. Audits shall be on at least 30 days' written notice, during normal business hours, and subject to reasonable confidentiality requirements. Customer agrees to exhaust independent third-party audit reports (e.g., SOC 2 Type II, ISO 27001) first. On-site audits are at Customer's expense.

(a) General. Stellion OOD may transfer and process Personal Data outside the country where it was collected. All such transfers shall comply with Applicable Data Protection Laws.

(b) EEA/Swiss/UK Transfers. To the extent transfers are to countries without adequate data protection, the Parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference, with Module Two (Controller-to-Processor) and Module Three (Processor-to-Processor) selected as applicable. For UK transfers, the UK International Data Transfer Addendum is incorporated.

(c) Supplementary Measures. Where required, Stellion OOD will implement appropriate supplementary measures and provide reasonable assistance with transfer impact assessments.