Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the contractual relationship between GBCORP and a Customer who uses a GBCORP service ("Service") that involves GBCORP processing personal data on the Customer's behalf. This DPA gives effect to the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent international data-protection frameworks.

1) When This DPA Applies

This DPA applies whenever:

• The Customer is the data controller and GBCORP is acting as data processor in respect of personal data the Customer submits to a GBCORP Service, AND
• The applicable data-protection law requires a written processor agreement

Where the GBCORP Service involves GBCORP acting as a controller (e.g., for billing, account management, or analytics), GBCORP's Privacy Policy applies in that capacity.

2) Definitions

Terms used in this DPA that are defined in the GDPR (including Controller, Processor, Data Subject, Personal Data, Processing, Sub-processor, and Personal Data Breach) have the meanings given in the GDPR. References to the GDPR include the UK GDPR.

3) Subject Matter, Duration, and Purpose

GBCORP will process Customer Personal Data only:

• For the duration of the underlying agreement between the Customer and GBCORP, plus any retention period required by law
• For the purpose of providing the contracted Service and meeting GBCORP's obligations under the underlying agreement
• On documented instructions from the Customer, including with regard to transfers of personal data to a third country, unless required to do otherwise by applicable law

4) Categories of Data and Data Subjects

Specific categories are described in the Service Order or equivalent. By default they may include:

• Data Subjects: the Customer's employees, customers, prospects, suppliers, and other contacts
• Personal Data: identification data, contact data, account credentials, transaction data, support communications, usage logs
• Special-category data: not processed by default; only if explicitly enabled in the Service Order and accompanied by appropriate safeguards

5) Processor Obligations

GBCORP will:

• Process Customer Personal Data only on documented written instructions from the Customer
• Ensure persons authorised to process the data are bound by confidentiality
• Implement appropriate technical and organisational security measures (see Annex)
• Assist the Customer with data-subject rights requests where reasonably possible
• Assist the Customer with security, breach-notification, and impact-assessment obligations
• Delete or return Customer Personal Data at the end of the service period, at the Customer's choice (unless retention is required by law)
• Make available all information necessary to demonstrate compliance with this DPA

6) Sub-processors

The Customer authorises GBCORP to engage sub-processors. The current list is published at gbcorp.org/subprocessors. GBCORP will give the Customer at least 30 days' prior notice of any intended change (additions or replacements). The Customer may object on reasonable data-protection grounds; if the parties cannot agree, the Customer may terminate the affected Service.

GBCORP will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for sub-processor compliance.

7) International Transfers

Where GBCORP transfers Customer Personal Data from the EEA, United Kingdom, or Switzerland to a country that does not have adequacy status, GBCORP relies on the European Commission Standard Contractual Clauses (2021 SCCs) and the UK International Data Transfer Addendum (or IDTA), as applicable. The Customer hereby authorises GBCORP to enter into the SCCs / IDTA on its behalf with sub-processors where necessary.

8) Personal Data Breach

GBCORP will notify the Customer without undue delay (and in any event within 72 hours where reasonably possible) after becoming aware of a Personal Data Breach affecting Customer Personal Data. GBCORP will provide reasonably available information to assist the Customer in meeting its own breach-notification obligations.

9) Audit

The Customer may, no more than once per calendar year and on reasonable advance notice, request information reasonably necessary to verify GBCORP's compliance with this DPA. GBCORP will provide responses to written questionnaires, copies of relevant third-party audit reports (SOC 2 Type II, ISO 27001, etc.) where available, and may, in appropriate cases, host an on-site audit subject to mutually agreed conditions.

10) Return or Deletion of Data

On termination or expiry of the Service, GBCORP will, at the Customer's choice, delete or return all Customer Personal Data within 30 days, except to the extent retention is required by applicable law.

11) Liability

Liability under this DPA is subject to the liability provisions of the underlying agreement between the Customer and GBCORP, unless otherwise required by applicable data-protection law.

12) Annex — Security Measures

GBCORP's technical and organisational measures include (without limitation):

• Encryption of Customer Personal Data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Role-based access control with least-privilege principles
• Multi-factor authentication for administrative access
• Centralised audit logging with retention of at least 12 months
• Background checks on staff with privileged access
• Annual penetration testing and continuous vulnerability management
• Documented incident-response and business-continuity plans
• Regular security training for all staff

13) Contact

DPA enquiries and execution: [email protected]