SOP data processing addendum

Effective date: 22 October 2026

Version: 1

This Data Processing Addendum ("DPA") is entered into between SyncDit B.V., KvK 42099785, Koninginnegracht 23, 2514 AB Den Haag, the Netherlands ("Syncdit"), and the customer identified in the order form for SOP ("Customer"). It forms part of the Customer's agreement with Syncdit (the "Agreement"), such as an order form under Syncdit's Master Services Agreement, and implements Article 28(3) GDPR for Syncdit's processing of personal data on the Customer's behalf. Where the Customer and Syncdit sign a customer-specific data processing agreement, that agreement applies instead of this DPA.

1. Definitions

Terms defined in the GDPR (Regulation (EU) 2016/679) have the same meaning here. "Customer Personal Data" means personal data that Syncdit processes on the Customer's behalf under the Agreement, as described in Annex A. "Subprocessor" means a third party that Syncdit engages to process Customer Personal Data. "SCCs" means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.

2. Roles and instructions

2.1 The Customer is controller and Syncdit is processor of Customer Personal Data. Where the Customer processes the data on behalf of another controller, Syncdit is the Customer's subprocessor, the Customer confirms that its instructions are covered by that controller's authorisation, and the Customer remains Syncdit's only point of contact.

2.2 Syncdit processes Customer Personal Data only on the Customer's documented instructions, including for international transfers, unless EU or Member State law requires otherwise; Syncdit then informs the Customer first, unless that law prohibits it. The Agreement, this DPA and the Customer's use of SOP's settings and features are the Customer's complete instructions. Syncdit informs the Customer immediately if, in its opinion, an instruction infringes data protection law.

2.3 The Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data, including the legal grounds for processing and the privacy information given to data subjects.

2.4 Syncdit acts as an independent controller only for its own business purposes, such as business contacts, account administration and security, as described in its privacy policy. That processing is outside this DPA.

3. Confidentiality

Syncdit ensures that everyone authorised to process Customer Personal Data is bound by confidentiality and has access only where needed for their work. Syncdit's contact for all matters under this DPA is legal@syncdit.ai.

4. Security

Syncdit implements and maintains the technical and organisational measures in Annex B, which are appropriate to the risk as required by Article 32 GDPR. Syncdit may update them, but will not materially reduce the overall level of protection.

5. Subprocessors

5.1 The Customer gives general written authorisation for the Subprocessors on the subprocessor list, which forms Annex C. Syncdit imposes on each Subprocessor, by written contract, data protection obligations materially equivalent to this DPA, and remains fully liable to the Customer for their performance.

5.2 Syncdit gives at least 30 days' prior written notice of a new or replacement Subprocessor. The Customer may object on reasonable data protection grounds within 14 days. The parties then discuss a solution in good faith, including a configuration that avoids the new Subprocessor. If none is found, either party may terminate the affected services from the date of the change, and Syncdit refunds prepaid fees for the unused period. An emergency replacement needed to address an imminent security or continuity risk may take effect immediately; Syncdit then gives notice within 5 business days, and the same objection and termination rights apply.

6. Assistance and data subject requests

6.1 Taking into account the nature of the processing, Syncdit helps the Customer respond to requests from data subjects exercising their rights under Chapter III GDPR. Operators can find, export, correct, restrict and delete a person's records in SOP.

6.2 If Syncdit receives a request that concerns the Customer, it forwards it to the Customer without undue delay and within 5 business days, and does not respond to it itself except to refer the person to the Customer.

6.3 Syncdit assists the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), taking into account the nature of the processing and the information available to Syncdit.

7. Personal data breaches

Syncdit notifies the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information may follow in phases. Syncdit contains and remedies the breach, documents it and cooperates with the Customer's notifications. Syncdit does not notify authorities or data subjects on the Customer's behalf.

8. International transfers

Customer Personal Data is hosted in Google Cloud in the Netherlands. Syncdit transfers it outside the European Economic Area only as stated in Annex C or with the Customer's prior written authorisation. For a transfer to a country without an adequacy decision, Syncdit ensures a safeguard under Chapter V GDPR, in particular the SCCs (Module Two or Three, as applicable), with supplementary measures where a transfer assessment requires them. For importers certified under the EU–US Data Privacy Framework, Syncdit may rely on that adequacy decision while it is valid, with the SCCs as fallback.

9. Audits and information

9.1 Syncdit makes available the information needed to demonstrate compliance with Article 28 GDPR, including descriptions of its security measures, Subprocessor information and answers to reasonable written security questionnaires, at most twice a year.

9.2 Where that information is reasonably insufficient, after a personal data breach or where a supervisory authority requires it, the Customer or an independent auditor bound by confidentiality may audit Syncdit's compliance with this DPA. Audits take place at most once every 12 months, on at least 30 days' written notice, during business hours, remotely where possible and without access to other customers' data. Each party bears its own costs, unless the audit shows material non-compliance.

10. Return and deletion

10.1 At the end of the Agreement, Syncdit exports the Customer's data on request in a commonly used format (CSV or JSON, with the original documents) within 30 days of the request, free of charge for one export.

10.2 Syncdit then deletes Customer Personal Data from active systems within 30 days, and from backups through scheduled expiry within 60 days. Backups stay encrypted until they expire, and deletions are re-applied after any restore. Syncdit confirms deletion in writing on request.

10.3 Syncdit keeps Customer Personal Data longer only where EU or Member State law requires it, separated from active processing and only for as long as required.

11. Liability, duration and law

11.1 The liability provisions of the Agreement apply to this DPA. This does not affect either party's liability to data subjects or fines imposed under Article 83 GDPR.

11.2 This DPA applies for as long as Syncdit processes Customer Personal Data under the Agreement. Clauses 7, 10 and 11 continue until deletion is complete.

11.3 If data protection law or a decision of a court or supervisory authority materially affects this DPA, including the validity of a transfer mechanism, the parties agree in good faith on the changes needed.

11.4 This DPA is governed by Dutch law, and disputes go to the competent court in Amsterdam, the Netherlands, without prejudice to mandatory rules of data protection law.

Annex A. Description of the processing

Annex B. Technical and organisational measures

Annex C. Subprocessors

The authorised Subprocessors, with their service, location and transfer safeguard, are those on the subprocessor list at the date of the Agreement, as updated under clause 5.