Data Processing Addendum

Vrymnox Systems LLC, doing business as Vrymdor

This Data Processing Addendum (this "DPA") is part of the Master Services Agreement (the "Agreement") between Vrymnox Systems LLC, a Nebraska limited liability company that also does business as Vrymdor ("Vrymnox"), and the customer identified below ("Customer"). It applies to Vrymnox's Processing of Customer Personal Data in providing the Services. Capitalized terms not defined in this DPA have the meanings in the Agreement. If this DPA conflicts with the Agreement as to the Processing of Customer Personal Data, this DPA controls.

1. Definitions

1.1 "Data Protection Laws" means all laws that apply to the Processing of Customer Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into United Kingdom law ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), and other U.S. state comprehensive privacy laws.

1.2 "Customer Personal Data" means personal data or personal information (as those terms are defined in Data Protection Laws) contained in Customer Data that Vrymnox Processes on Customer's behalf under the Agreement.

1.3 "Process" or "Processing," "Controller," "Processor," "Data Subject," and "Supervisory Authority" have the meanings in the GDPR. "Controller" includes a "business" and "Processor" includes a "service provider" or "processor" under U.S. state privacy laws.

1.4 "Security Incident" has the meaning in Section 12.2 of the Agreement, as it relates to Customer Personal Data.

1.5 "Subprocessor" means any third party Vrymnox engages to Process Customer Personal Data.

1.6 "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner.

2. Roles and Scope

2.1 Roles. Customer is the Controller (or a Processor acting for its own Controller), and Vrymnox is the Processor (or Subprocessor) of Customer Personal Data. Vrymnox is an independent Controller of Service Data and of billing contact and payment information about Customer's personnel, which Vrymnox handles under its Privacy Notice published at https://vrymdor.com/privacy.

2.2 Self-Hosted Software and Central Guardian. When Customer uses the Self-Hosted Software or a Central Guardian deployed in Customer's environment, analysis is performed in Customer's environment, and Vrymnox does not Process the content of Customer's traffic except to the extent Customer forwards it to the Control Plane, turns on a feature that sends it as described in Section 11.4 of the Agreement, or provides it for support. This DPA applies only to Customer Personal Data that Vrymnox actually receives.

2.3 Details of Processing. The subject matter, nature, purpose, duration, categories of data, and categories of Data Subjects are described in Annex 1.

3. Customer's Obligations

Customer is responsible for: (a) the lawfulness of the Customer Personal Data it provides and its instructions; (b) giving all required notices and obtaining all required consents or other legal bases, including for routing, inspecting, logging, and redacting the traffic of its personnel and Agents; (c) configuring the Services, including redaction policies and retention settings, appropriately for the data it sends; and (d) not sending special categories of personal data, protected health information, payment card data, or criminal justice information to the Services except as permitted by Section 11.3 of the Agreement.

4. Vrymnox's Obligations

4.1 Instructions. Vrymnox will Process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's configuration and use of the Services, unless the law requires otherwise, in which case Vrymnox will inform Customer before Processing unless the law prohibits it. Vrymnox will tell Customer if it believes an instruction violates Data Protection Laws.

4.2 Confidentiality. Vrymnox will ensure that personnel authorized to Process Customer Personal Data are bound by confidentiality obligations.

4.3 Security. Vrymnox will implement the technical and organizational measures in Annex 2. Vrymnox may update those measures so long as the update does not materially reduce the overall level of protection.

4.4 No Training or Secondary Use. Vrymnox will not use Customer Personal Data to train or improve any artificial intelligence model made available to anyone other than Customer, or for any purpose other than providing, securing, and supporting the Services.

4.5 CCPA Service Provider Terms. To the extent the CCPA applies, Vrymnox will not: (a) sell or share Customer Personal Data (as those terms are defined in the CCPA); (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer; or (c) combine it with personal information Vrymnox receives from others, except as the CCPA permits. Vrymnox will comply with the CCPA's applicable obligations, provide the same level of privacy protection the CCPA requires, notify Customer if it can no longer meet its obligations, and allow Customer to take reasonable steps to stop and remediate unauthorized use. Vrymnox certifies that it understands these restrictions.

5. Subprocessors

5.1 Authorization. Customer authorizes Vrymnox to engage Subprocessors. The current list is in Annex 3 and at https://vrymdor.com/subprocessors. Vrymnox will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA, and remains responsible for each Subprocessor's performance.

5.2 Changes. Vrymnox will notify Customer at least thirty (30) days before adding or replacing a Subprocessor, by email, and the list at https://vrymdor.com/subprocessors is updated at the same time. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services and receive a refund of prepaid fees for the remainder of the Subscription Term.

6. Data Subject Requests and Assistance

Taking into account the nature of the Processing, Vrymnox will provide reasonable assistance, including through the Services' features, to help Customer respond to Data Subject requests, carry out data protection impact assessments, and consult with Supervisory Authorities. If Vrymnox receives a request directly from a Data Subject relating to Customer Personal Data, it will refer the person to Customer and will not respond except as required by law.

7. Security Incidents

Vrymnox will notify Customer of a Security Incident affecting Customer Personal Data without undue delay, and in any event within seventy-two (72) hours after confirming it, and will provide the information reasonably available to Vrymnox that Customer needs to meet its own notification obligations, including, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Notification is not an admission of fault.

8. Deletion and Return

At the end of the Agreement, Vrymnox will delete or return Customer Personal Data as described in Section 11.5 of the Agreement, unless the law requires Vrymnox to keep it, in which case Vrymnox will keep it confidential and Process it only as the law requires.

9. Audits

Vrymnox will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA. Customer agrees that this obligation is satisfied first by Vrymnox providing, on request and under confidentiality, its most recent independent security assessment or certification report (if any), completed security questionnaires, and summaries of relevant policies. If that information is not sufficient to meet a requirement of Data Protection Laws, Customer may conduct an audit, not more than once in any twelve (12) month period (unless required by a Supervisory Authority or following a Security Incident), on at least thirty (30) days' notice, during normal business hours, in a manner that does not compromise the security of the Services or other customers' data, and at Customer's expense.

10. International Transfers

10.1 Transfers. Vrymnox may Process Customer Personal Data in the United States and in other countries where Vrymnox and its Subprocessors operate.

10.2 EU Transfers. To the extent Customer Personal Data subject to the GDPR is transferred to Vrymnox in a country that is not recognized as providing adequate protection, the parties incorporate the Standard Contractual Clauses by reference, as follows: Module Two (Controller to Processor) applies where Customer is a Controller, and Module Three (Processor to Processor) applies where Customer is a Processor; the optional docking clause in Clause 7 applies; under Clause 9, option 2 (general written authorization) applies, with the notice period in Section 5.2 of this DPA; the optional language in Clause 11 does not apply; under Clauses 17 and 18, the law and courts of Ireland apply; and Annexes I and II of the Standard Contractual Clauses are completed by Annexes 1 and 2 of this DPA. If Vrymnox participates in the EU-U.S. Data Privacy Framework, transfers may instead rely on that framework while Vrymnox's certification is active.

10.3 UK and Swiss Transfers. For Customer Personal Data subject to the UK GDPR, the UK Addendum applies, with Table 1 completed by the parties' details in this DPA, Table 2 by the selections in Section 10.2, Table 3 by Annexes 1 through 3, and Table 4 allowing either party to end the UK Addendum as permitted by its Section 19. For Customer Personal Data subject to Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to Swiss law, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority where required.

10.4 Conflict. If the Standard Contractual Clauses or UK Addendum conflict with this DPA or the Agreement, the Standard Contractual Clauses or UK Addendum control.

11. Liability

Each party's liability arising from this DPA is subject to the limitations of liability in the Agreement, except to the extent those limitations are prohibited by Data Protection Laws or the Standard Contractual Clauses.

12. Term

This DPA lasts as long as Vrymnox Processes Customer Personal Data under the Agreement.

Annex 1: Details of Processing

Parties. Data exporter: the Customer named in the signature block of this DPA, at the address and contact stated there, using the Services. Data importer: Vrymnox Systems LLC, 200 S 21st Street, Suite 400A, Lincoln, Nebraska 68510, contact [email protected].

Subject matter and nature of Processing. Receiving, storing, analyzing, and displaying Customer Data to provide the Control Plane, including the customer dashboard, approvals, connector health and counts, network scan results and security events that Customer chooses to send, AI agent governance records, security awareness campaigns, support, and the client portal, and scheduling and holding support and project calls with Customer's personnel after the Agreement begins; processing content Customer submits to the Control Plane with the Vrymnox-hosted Central Guardian, which uses a locally hosted model; operating any Gateway Proxy that Vrymnox hosts for Customer; and processing Customer Materials in the Studio Pipeline to perform Studio Services.

Purpose. Providing, securing, and supporting the Services under the Agreement.

Duration. The term of the Agreement plus the deletion period in Section 11.5 of the Agreement.

Frequency. Continuous while Customer uses the Services.

Categories of Data Subjects. Customer's employees, contractors, and Authorized Users; staff that Customer enrolls in security awareness campaigns; individuals named in security events Customer forwards to the Control Plane; individuals whose personal data appears in content that Customer or its Agents submit to the Services (which may include Customer's customers and other third parties); and individuals who appear in or are named in Customer Materials provided for Studio Services.

Categories of personal data. Account and contact information of Authorized Users (such as names, email addresses, job titles, and authenticator registrations); sign-in and audit records (such as IP addresses, timestamps, and actions taken); security awareness data (names, email addresses, and departments of enrolled staff, and their campaign results, such as link clicks and training completion); user names and account identifiers that appear in forwarded security events; the content of support tickets; call recordings and transcripts, only when the participants agree; and any personal data contained in other Customer Content, which Customer controls.

Special categories of data. None intended. Customer will not send special categories of personal data except as permitted by the Agreement.

Retention. Security events, connector counts, and scan results are deleted after the retention period stated for Customer's plan in the Order or the Documentation. Other Customer Personal Data is kept while the account exists and deleted as described in Section 11.5 of the Agreement. Encrypted backups expire after thirty (30) days.

Competent Supervisory Authority. The authority determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Technical and Organizational Security Measures

Encryption in transit: TLS 1.2 or higher for all traffic over public networks. The servers accept no inbound connections from the internet and are reached only through an encrypted tunnel.

Encryption at rest: backups are encrypted before they leave the server, with the decryption key kept off the server; access tokens, authenticator secrets, and Studio media are encrypted with AES-256-GCM.

Access control: role-based access on a least-privilege basis; multi-factor authentication for every user; operator access to admin.vrymnox.com only through Cloudflare Access with multi-factor authentication; hardware security key approval for high-risk operator actions; prompt revocation of access when personnel leave.

Tenant isolation: logical separation of each customer's data and configurations, enforced in the application, with database row-level security on tenant tables.

Logging and monitoring: append-only logs of administrative access and actions, which Customer can review for its own account; automated monitoring of service health, storage, and backups, with alerts to the operator.

Secure development: automated tests on every change, automated dependency updates, container images pinned to verified versions, and separate development, demonstration, and production environments.

Vulnerability management: weekly vulnerability scanning of dependencies and automatic installation of operating system security updates.

Physical security: servers are hosted in DigitalOcean data centers under the provider's physical access controls, and Vrymnox keeps no Customer Data on paper or on local office equipment.

Personnel: access to Customer Data is limited to named personnel who are bound by confidentiality obligations.

Business continuity: nightly encrypted backups stored off the server, each checked when it is made, regular restore drills, and a documented recovery runbook.

Incident response: Security Incidents are handled under the notification commitments in Section 7 of this DPA.

Subprocessor management: Subprocessors are bound by written data protection terms.

Data minimization: personal data is redacted before Control Plane text is analyzed by the locally hosted model, and Studio Services rely on Customer not including personal data in Customer Materials, as Section 6.5 of the Agreement requires; retention periods by plan with automatic deletion; no use of Customer Content to train shared models.

Annex 3: Subprocessors