Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the DeploySeal Terms of Service between:

• Controller: The customer entity that has accepted the Terms of Service (“Customer”).
• Processor: [DeploySeal legal entity name and address — to be confirmed] (“DeploySeal”).

This DPA applies where DeploySeal processes personal data on behalf of the Customer in the course of providing the Service and where such processing is subject to GDPR (EU 2016/679), UK GDPR, or equivalent data protection legislation.

DeploySeal processes personal data as necessary to provide the Service described in the Terms of Service. Processing continues for the duration of the subscription and any retention period specified in the Privacy Policy.

DeploySeal processes personal data to:

• Authenticate and manage user accounts.
• Deliver campaign management features, including tester invitations, testing workflows, issue tracking, and sign-off records.
• Send transactional email notifications on behalf of the Customer.
• Maintain audit logs for compliance and security purposes.

• Names and email addresses of Customer users and invited testers.
• Organisation names and role assignments.
• User-generated content within the Service (issue descriptions, notes, sign-off comments).
• Technical log data including IP addresses and request metadata.

• Customer employees and contractors who use the Service.
• External testers invited to participate in a campaign.

DeploySeal agrees to:

• Process personal data only on documented instructions from the Customer.
• Ensure persons authorised to process the personal data have committed to confidentiality.
• Implement appropriate technical and organisational security measures as described in Annex II.
• Assist the Customer in responding to data subject rights requests and other obligations under applicable data protection law.
• Delete or return all personal data to the Customer upon termination of the Service, at the Customer’s election.
• Make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or a mandated auditor.

The Customer provides general authorisation for DeploySeal to engage sub-processors. DeploySeal will maintain an up-to-date list of sub-processors and notify the Customer of any additions or replacements in advance, providing an opportunity to object.

Current sub-processors include infrastructure and hosting providers listed in the Privacy Policy. [Full sub-processor list to be published before commercial launch.]

[Standard Contractual Clauses or alternative transfer mechanisms — to be completed by legal counsel prior to commercial launch and prior to any transfer of personal data outside the EEA/UK.]

DeploySeal implements, at minimum:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest for database storage.
• Role-based access control with principle of least privilege.
• Multi-factor authentication for administrative access.
• Regular automated backups with tested restore procedures.
• Vulnerability management and dependency scanning in the CI/CD pipeline.
• Incident response procedures with notification obligations as required by law.

DeploySeal will notify the Customer without undue delay (and in any event within 72 hours where feasible) upon becoming aware of a personal data breach that may require notification under applicable law, and will provide reasonable assistance in meeting the Customer’s notification obligations.

[To match the governing law of the Terms of Service — to be confirmed by legal counsel.]

To request an executed DPA or raise data processing questions: legal@DeploySeal.com