Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into between Peerlify, Inc. ("Peerlify," "we," "us") and the customer identified in the Agreement ("Customer," "you"). This DPA supplements the Peerlify Terms of Service or any other written agreement between the parties governing Customer's use of the Service (collectively, the "Agreement") and applies whenever Peerlify processes Personal Data on behalf of Customer in connection with the Service.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

• "Applicable Data Protection Law" means each law applicable to the processing of Personal Data under this DPA, including the EU GDPR, the UK GDPR, the Swiss FADP, the Québec Act respecting the protection of personal information in the private sector (as amended by Law 25), PIPEDA, the California Consumer Privacy Act as amended (CCPA/CPRA), and other comprehensive U.S. state privacy laws.
• "Customer Personal Data" means Personal Data that Peerlify processes on behalf of Customer in connection with the Service.
• "Data Subject," "Processing," "Controller," "Processor," and "Personal Data" have the meanings given in the EU GDPR. References to a "data subject right" include the equivalent right under any Applicable Data Protection Law.
• "Personal Data Breach" has the meaning given in the EU GDPR.
• "SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission in Decision 2021/914.
• "UK Addendum" means the international data transfer addendum to the SCCs issued by the UK Information Commissioner's Office.
• "Subprocessor" means a third party engaged by Peerlify to process Customer Personal Data.

2. Roles and scope

For the purposes of Applicable Data Protection Law and in relation to Customer Personal Data: Customer is the Controller (or, where Customer is itself a processor of a third party, the processor); Peerlify is the Processor (or sub-processor, respectively). Where the CCPA/CPRA applies, Peerlify acts as a "service provider" and will process Customer Personal Data only for the business purposes set out in the Agreement.

Each party will comply with its obligations under Applicable Data Protection Law in respect of the processing of Customer Personal Data.

3. Processing of personal data

The subject matter, duration, nature, and purpose of processing, categories of Data Subjects, and categories of Personal Data are described in Annex I. Peerlify will process Customer Personal Data only:

• To provide, support, and maintain the Service in accordance with the Agreement.
• On Customer's documented instructions (the Agreement, this DPA, and Customer's configuration of the Service constitute those instructions).
• To comply with applicable law, in which case Peerlify will inform Customer of the legal requirement before processing unless prohibited from doing so.

Peerlify will not sell, share for cross-context behavioral advertising, retain, use, or disclose Customer Personal Data for any purpose other than the specific business purpose of performing the Service, and will not combine Customer Personal Data with personal information from other sources except to detect security incidents or comply with law.

4. Customer instructions

Customer warrants that its instructions, including those provided through its configuration of the Service, are lawful. If Peerlify believes an instruction infringes Applicable Data Protection Law, it will inform Customer promptly. Peerlify may suspend processing of an instruction until Customer confirms or modifies it where continued processing would create unlawful risk for either party.

5. Personnel and confidentiality

Peerlify ensures that personnel authorized to process Customer Personal Data are bound by a confidentiality obligation (either contractual or statutory), are trained on their data-protection responsibilities, and access Customer Personal Data on a need-to-know basis.

6. Security

Peerlify implements and maintains the technical and organizational measures described in Annex II, taking into account the state of the art, the costs of implementation, the nature and scope of the processing, and the risk for Data Subjects. Peerlify may update these measures from time to time provided that the level of protection is not materially reduced.

7. Subprocessors

Customer grants Peerlify a general written authorization to engage Subprocessors, provided that Peerlify:

• Maintains and publishes a list of Subprocessors at peerlify.com/legal/subprocessors, including names, processing activities, and locations.
• Imposes on each Subprocessor data-protection obligations no less protective than those in this DPA.
• Remains liable to Customer for the acts and omissions of its Subprocessors that cause Peerlify to breach this DPA.

Peerlify will provide at least 30 days' advance notice of any addition or replacement of a Subprocessor through its Subprocessor change feed. Customer may object to a change for reasonable data-protection grounds within that window; if the parties cannot resolve the objection, Customer may terminate the affected portion of the Service and receive a pro-rated refund of prepaid fees for the unused remainder of the term.

8. International data transfers

Customer authorizes Peerlify to transfer Customer Personal Data outside of the jurisdiction in which it was collected to the locations identified in Annex III and to other locations as required to provide the Service. For transfers that require additional safeguards under Applicable Data Protection Law, the following apply:

• EU / EEA — the SCCs (Module Two: Controller-to-Processor; or Module Three: Processor-to-Processor, as applicable) are incorporated by reference, with the Annexes populated as set out below.
• United Kingdom — the SCCs are amended by the UK Addendum, incorporated by reference.
• Switzerland — the SCCs apply with the modifications recommended by the Swiss Federal Data Protection and Information Commissioner; references to "GDPR" are read as "FADP," to "Member State law" as "Swiss law," and supervisory authority is the FDPIC.
• Québec / Canada — Peerlify conducts a privacy impact assessment for transfers outside Québec under Section 17 of the Québec Act, as further described in Section 9 below.

For the purposes of the SCCs: (i) Module Two is the default; (ii) the optional docking clause (Clause 7) does not apply; (iii) the general written authorization option in Clause 9(a) applies with a 30-day notice period; (iv) the optional language in Clause 11(a) does not apply; (v) governing law in Clause 17 is the law of Ireland and the competent court in Clause 18 is in Ireland.

9. Québec Law 25 specifics

Because Peerlify is established in Québec, the following provisions apply to the handling of Customer Personal Data covered by the Québec Act respecting the protection of personal information in the private sector (as modernized by Law 25):

• Privacy Officer. Peerlify has designated a person in charge of the protection of personal information whose contact information is published in our Privacy Policy.
• Confidentiality by default. The Service's privacy parameters provide the highest level of confidentiality by default. Personal information is collected only to the extent necessary for the purposes for which it is collected.
• Transfers outside Québec. Before transferring personal information outside Québec, Peerlify carries out a privacy impact assessment that considers the sensitivity of the information, the purposes of its use, the protection measures that would apply (including contractual measures), and the legal regime applicable in the destination jurisdiction.
• Confidentiality incident register. Peerlify keeps a register of confidentiality incidents and provides relevant information to Customer in support of Customer's own register obligations.
• Automated decisions. Peerlify does not use Customer Personal Data to make decisions about Data Subjects based exclusively on automated processing that produce legal or similarly significant effects.

10. Assistance with data subject rights

Taking into account the nature of the processing, Peerlify will assist Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law. The Service includes self-service mechanisms (member directory, audit export, deletion controls) that Customer can use to respond to most requests directly. Where Peerlify receives a request from a Data Subject relating to Customer Personal Data, Peerlify will, without undue delay, redirect the Data Subject to Customer.

11. Personal data breaches

Peerlify will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will include, to the extent known at the time:

• The nature of the breach and, where possible, the categories and approximate number of Data Subjects and records concerned.
• The likely consequences.
• The measures taken or proposed to address the breach and to mitigate its possible adverse effects.
• The contact point for further information.

Peerlify will provide reasonable cooperation to Customer in the investigation, mitigation, and remediation of the breach and, where applicable, in notifications to supervisory authorities and Data Subjects. Notifications to Customer are not an admission of fault or liability.

12. DPIAs and prior consultation

Peerlify will provide Customer with reasonable assistance, at Customer's expense, where Customer is required by Applicable Data Protection Law to carry out a data-protection impact assessment (DPIA), Privacy Impact Assessment, or prior consultation with a supervisory authority that relates to Customer's use of the Service.

13. Return and deletion

Upon the end of the Agreement, Peerlify will, at Customer's choice, delete or return Customer Personal Data and delete existing copies, unless retention is required by applicable law. Standard export mechanisms in the Service remain available for 30 days after termination. Active-system data is then deleted; backups age out within 90 days.

14. Audits and information

Peerlify will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. Customer may verify Peerlify's compliance through:

• Independent third-party audit reports (such as SOC 2 Type II, when available) and certifications, which Peerlify will provide on request under confidentiality.
• A documentation-based review conducted in writing.
• Where reasonably required by Applicable Data Protection Law and where the foregoing is insufficient, an on-site audit conducted by Customer or a mutually agreed independent auditor, on at least 30 days' written notice, no more than once per year (except in the case of a supervisory-authority direction or a Personal Data Breach), during business hours, subject to confidentiality and to a reasonable scope agreed in advance. Customer will reimburse Peerlify's reasonable costs for the audit at Peerlify's then-current professional-services rates.

15. Liability

Each party's liability arising out of or in connection with this DPA (including the SCCs and the UK Addendum) is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits Data Subjects' rights under Applicable Data Protection Law.

16. General

In the event of any conflict between the terms of the Agreement and this DPA, this DPA prevails. In the event of any conflict between this DPA and the SCCs or UK Addendum, the SCCs and UK Addendum prevail with respect to international transfers. This DPA is governed by the law that governs the Agreement, except where Applicable Data Protection Law requires otherwise.

Annex I — Description of processing

A. List of parties. Data exporter: the Customer identified in the Agreement, acting as Controller (or processor). Data importer: Peerlify, Inc., Montréal, Québec, Canada, acting as Processor (or sub-processor).

B. Description of transfer.

• Categories of Data Subjects. Customer's authorized users (Owners, Admins, IT Admins, Network Admins, Billing Admins, Auditors, Members); end users of devices Customer enrolls; Customer's billing contacts.
• Categories of Personal Data. Identification and authentication data (name, email, OIDC subject); device and connection metadata (device name, public key, OS, assigned overlay IP, last-seen timestamp, transient connection metadata); audit-event data (actor, action, target, timestamp, change diff); billing-contact and commercial data.
• Sensitive data. The Service is not designed to process special categories of Personal Data, criminal-conviction data, biometric data, or other sensitive personal information. Customers should not submit such data to the Service except in restricted-scope deployments configured with appropriate additional measures.
• Frequency of transfer. Continuous, for so long as Customer uses the Service.
• Nature and purpose of processing. Hosting, transmission, security, support, and operation of the Peerlify control plane and relays.
• Retention. As described in the Agreement, the Privacy Policy, and Customer's plan configuration.

C. Competent supervisory authority. For SCC purposes, the Irish Data Protection Commission, unless Applicable Data Protection Law designates another competent authority.

Annex II — Technical and organizational measures

Peerlify maintains a written information security program that includes administrative, technical, and physical safeguards reasonably designed to protect Customer Personal Data. The following is a summary of measures in effect as of the DPA's effective date; specific controls evolve over time.

• Encryption. TLS 1.2+ in transit between client and control plane; AES-256 at rest for production data stores; peer-to-peer traffic encrypted end-to-end with Noise IK and AES-GCM with directional keys.
• Key management. Production secrets stored in a managed key vault with rotation and audit logging. Peer node keys never leave the peer.
• Access control. SSO with multi-factor authentication for Peerlify personnel; role-based access; least privilege; quarterly access reviews. Server-side authorization enforced on every Service mutation.
• Network security. Production network segmented from corporate; default-deny ingress and egress; private VPCs; bastion access only.
• Application security. Static and dependency scanning in CI; reproducible signed builds for client releases; secrets scanning; protected branches and required reviews.
• Logging and monitoring. Centralized logging of administrative actions; anomaly alerts; tamper-evident retention.
• Personnel. Background checks where permitted by law; security and privacy training on onboarding and annually; written confidentiality obligations.
• Vendor management. Pre-engagement security review of Subprocessors; written data-protection terms; annual review.
• Incident response. 24/7 on-call; documented playbooks; tabletop exercises; post-incident review.
• Business continuity. Production data replicated across availability zones; tested backup and restore.
• Physical security. Production infrastructure hosted in tier-3+ data centres operated by major cloud providers with their own physical-security controls.

Additional context is published on our Security page.

Annex III — Subprocessors

The current list of Subprocessors authorized to process Customer Personal Data is published at peerlify.com/legal/subprocessors. Each Subprocessor's name, country, and processing activity are listed there. Customer may subscribe to a feed of changes from that page.