Data Processing Agreement

1. Parties

2. Subject Matter & Details of Processing

3. Controller Obligations

• The Controller shall have a lawful basis for processing personal data under GDPR Article 6 (and Article 9 for special categories)
• The Controller is responsible for providing appropriate privacy notices to data subjects
• The Controller shall respond to data subject rights requests and may request Processor assistance (see Section 5)
• The Controller shall notify the Processor of any changes in applicable data protection law that may affect processing activities
• The Controller shall ensure that data transferred to the Processor is accurate and lawfully obtained

4. Processor Obligations (GDPR Article 28 Compliant)

4.1 Documented Instructions

The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by applicable law.

4.2 Confidentiality

The Processor shall ensure that persons authorized to process personal data are under appropriate obligations of confidentiality. All personnel with access to personal data are bound by confidentiality obligations.

4.3 Security Measures

The Processor implements appropriate technical and organizational security measures including: TLS 1.3 encryption in transit, AES-256 encryption at rest for connected social account tokens (full disk and database encryption at rest planned), bcrypt password hashing, role-based access control, audit logging, Cloudflare WAF protection, and account lockout mechanisms.

4.4 Sub-Processor Management

The Processor shall not engage sub-processors without prior written authorization from the Controller (general authorization is hereby provided for the sub-processors listed in Section 5). The Processor shall impose equivalent data protection obligations on sub-processors.

4.5 Data Subject Rights

The Processor shall assist the Controller in fulfilling data subject requests including: access, rectification, erasure, restriction, portability, and objection rights. Data subject deletion requests processed within 30 days.

4.6 Security Assistance

The Processor shall assist the Controller in ensuring compliance with security obligations, breach notifications, data protection impact assessments, and prior consultations with supervisory authorities where required.

4.7 Deletion or Return on Termination

Upon termination of the Service Agreement, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies, unless applicable law requires storage of the personal data. Deletion completed within 30 days of termination.

4.8 Audit Cooperation

The Processor shall make available all information necessary to demonstrate compliance and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller, with reasonable notice (30 days minimum).

5. Approved Sub-Processors

The Processor will notify the Controller of any intended changes to sub-processors with at least 30 days notice, allowing the Controller to object to such changes.

6. International Data Transfers

To the extent that processing involves transfers of personal data from the European Economic Area (EEA) to countries not deemed adequate by the European Commission, such transfers are made pursuant to:

• Standard Contractual Clauses (SCCs): EU Commission Decision 2021/914 — available on request from Hypernova AI
• UK International Data Transfer Agreements (IDTA): Available where UK GDPR applies
• Adequacy decisions: Applied where applicable per European Commission findings

7. Data Breach Notification

• The Processor shall notify the Controller of a personal data breach without undue delay and in any event within 48 hours of becoming aware
• Notification shall include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed
• Further information may be provided in phases where all information is not yet available
• Breach notifications sent to: the Controller's designated security contact or the email address on file

8. Governing Law

This DPA is governed by the laws of the jurisdiction specified in the Service Agreement, and in the absence of such specification, by the laws of the State of the Processor's principal place of business. The parties submit to the jurisdiction of the courts of such jurisdiction.

Where this DPA is executed in relation to GDPR obligations, the EU General Data Protection Regulation (2016/679) shall govern data protection matters to the extent applicable.

9. Order of Precedence

In the event of conflict between this DPA and the main Service Agreement, this DPA shall take precedence with respect to data protection matters. The Service Agreement shall take precedence with respect to all other matters.

Document Control