Data processing
agreement

01Definitions

Terms not defined in this DPA have the meaning given in Regulation (EU) 2016/679 ("GDPR"). "Customer" means the entity that accepted the undrsight Terms of Service or signed an order form. "Customer Personal Data" means any personal data Customer or its users upload to, or cause to be processed through, the Service. "Sub-processor" means any third party engaged by us to process Customer Personal Data on our behalf.

02Scope & role

This DPA applies to our processing of Customer Personal Data as a processor on behalf of Customer as controller. Where Customer acts as a processor for its own customers (for example, an advisor providing due-diligence services to a fund client), this DPA operates as a processor-to- sub-processor agreement (GDPR Art 28(4), Module 3 of the SCCs).

03Processing on instructions

We will process Customer Personal Data only on Customer's documented instructions, including as set out in the Terms of Service, this DPA, and any configuration choices Customer makes in the Service (including those of its authorised users), unless required otherwise by EU or Member State law to which we are subject. In that case, we will inform Customer of the legal requirement before processing, unless that law prohibits such notice.

If we consider an instruction to infringe the GDPR or other EU or Member State data protection law, we will notify Customer without undue delay.

04Confidentiality

We will ensure that every person authorised to process Customer Personal Data is bound by a written confidentiality obligation, or is under an appropriate statutory obligation of confidence.

05Security measures

We will implement and maintain the technical and organisational measures set out in Annex II, designed to ensure a level of security appropriate to the risks presented by the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.

06Sub-processors

Customer provides general written authorisation to engage the sub-processors listed in Annex III.

If we intend to add or replace a sub-processor, we will notify Customer at least 30 days in advance. Customer may object on reasonable data-protection grounds within that notice period. If objection cannot be resolved, Customer may terminate the affected portion of the Service and receive a pro-rata refund of prepaid fees.

We will impose contractual obligations on each sub-processor that are no less protective than those in this DPA, and remain liable to Customer for sub-processor acts and omissions.

07International transfers

Where we transfer Customer Personal Data to a sub-processor located outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) in Module 2 (controller-to-processor) or Module 3 (processor-to- processor), as applicable, together with the supplementary measures described in Annex II.

By executing this DPA, the parties agree that the SCCs are incorporated by reference into this DPA. Where a conflict arises, the SCCs prevail for international transfer matters.

08Data-subject rights

We will, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights under Chapter III GDPR.

If we receive a request from a data subject directly, we will forward it to Customer without undue delay and refrain from responding ourselves unless authorised by Customer.

09Personal-data breaches

We will notify Customer of a personal-data breach affecting Customer Personal Data without undue delay, and in any event within 72 hours of our confirming the breach. The notification will include the information required under Art 33(3) GDPR to the extent known at the time, supplemented as further information becomes available.

We will co-operate with Customer and provide reasonable assistance in investigating, mitigating, and remediating any such breach, including assistance required for Customer to comply with Art 33 and 34 GDPR.

10DPIAs & consultation

Taking into account the nature of the processing and the information available to us, we will provide Customer with reasonable assistance with data-protection impact assessments (Art 35) and prior consultations with supervisory authorities (Art 36) where required.

11Audits

We will make available to Customer all information necessary to demonstrate compliance with Art 28 GDPR, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor it mandates.

In practice, we expect to satisfy this right by providing: (a) responses to reasonable written questions, (b) access to our latest third-party security assessment where one exists, and (c) once annually, an on-site audit by Customer or its auditor on reasonable notice, subject to confidentiality, conducted during business hours, and with no material disruption to our operations.

12Return & deletion

On termination of the Service, Customer may export Customer Personal Data via the Service's export functionality. After a 30-day grace window, we will delete all Customer Personal Data in live systems in accordance with our deletion pipeline, subject to the rolling backup window described in the Privacy policy. Backups fall out of scope within 30 days of deletion from live systems.

Audit logs that reference deletion events are retained per Customer's configured retention window as part of our immutable audit record.

13Liability

The liability caps and exclusions in the Terms of Service apply equally to this DPA. Nothing in this DPA limits liability that cannot be excluded under applicable law, including liability to data subjects under Art 82 GDPR.

A1Annex I — details of processing

Subject-matter & duration

Processing of Customer Personal Data as necessary to provide the Service, for the duration of Customer's subscription, plus any retention period set out in the Privacy policy.

Nature & purpose

Hosting, storage, collaboration, AI-assisted analysis, auditing, support, notification (email), and other processing activities necessary to operate the Service and fulfil Customer's reasonable instructions.

Categories of data subjects

• Customer's authorised users (employees, advisors, counterparties invited to a deal).
• Individuals referenced in Customer Content (e.g. signatories, counterparty employees, board members, advisers).

Categories of personal data

• Identification & contact data (name, email, role, work phone).
• Authentication data (hashed passwords, encrypted MFA secrets, session tokens).
• Professional information contained in deal documents (typically business contact information; sometimes personnel-file or compensation data in diligence contexts).
• Metadata generated by the Service (audit events, usage logs, analysis outputs).

Special categories

The Service is not designed to process special-category personal data (Art 9 GDPR). Customer should not upload such data without first implementing additional safeguards and notifying us in writing so we can assess any additional measures required.

A2Annex II — security measures

We maintain at least the following technical and organisational measures. These represent our baseline; the Service as deployed may go further.

• Access control: role-based access with least-privilege defaults; user-level MFA available via TOTP enrollment; JWT-based session authentication with configurable session lifetimes.
• Encryption: TLS 1.2+ for data in transit; AES-256 encryption at rest for the application database and object storage holding deal documents.
• Secret management: production secrets held in an access-controlled secrets manager; not present in source control or CI artefacts.
• Tenant isolation: every query enforces the authenticated caller's organization_id at the dependency-injection layer, rejecting cross-tenant probes before they reach business logic.
• Audit logging: append-only record of every mutation (user, organisation, document, analysis) with immutable retention per Customer's configured window (default 7 years).
• Deletion pipeline: soft-delete with a 24-hour grace window for accidental-deletion recovery, followed by hard delete that unlinks file-system artefacts and cascade-removes database rows; evidence of deletion persists in the audit record.
• Anti-malware: every uploaded file is scanned on ingest; infected files are rejected before the database record is written.
• Availability: daily backups retained 30 days; defined RTO / RPO targets tracked internally; documented disaster-recovery runbook.
• Change management: code review required on every production-bound change; automated test suite (400+ tests as of this version) gates deploys.
• Personnel: background checks where legally permitted; written confidentiality obligations; annual security training.
• Vendor management: written DPAs with every sub-processor; risk-tier review before onboarding a new sub-processor.
• Vulnerability management: dependency scanning in CI; responsible-disclosure channel at security@undrsight.com.

A3Annex III — sub-processors

Current sub-processors, as of the "last updated" date above: