Data Processing Addendum

Last Updated: October 12, 2026

This Data Processing Addendum (“DPA”) forms part of and is incorporated into the Locktera Terms of Service, Master Services Agreement, or other written or electronic agreement governing Customer's use of the Services (the “Agreement”), and is entered into between Locktera, Inc., a Texas corporation (“Locktera,” “we,” “us,” or “our”), and the entity that is a party to the Agreement (“Customer,” “you,” or “your”).

For purposes of this DPA, Customer may act as a Controller or as a Processor acting on behalf of another Controller, depending on the applicable Processing activities. Locktera acts as a Processor or Subprocessor, as applicable, when Processing Personal Data on Customer's behalf. Where the CCPA/CPRA applies, the parties' respective roles as Business and Service Provider or Contractor shall be determined in accordance with applicable law.

This DPA applies to the extent that Locktera processes Personal Data on behalf of Customer in connection with Customer’s access to and use of Locktera’s services, including the Locktera CORE API, Locktera Share, encryption services, cryptographic container services, SDKs, authorization systems, and related infrastructure (collectively, the “Services”).

This DPA establishes the parties’ respective rights and obligations regarding the Processing of Personal Data and is intended to ensure compliance with applicable Data Protection Laws, including but not limited to:

Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)

The UK GDPR and UK Data Protection Act 2018

The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)

And other applicable privacy and data protection laws and regulations

For purposes of this DPA:

Where Customer acts as a Controller, Locktera acts as a Processor on Customer's behalf.

Where Customer acts as a Processor on behalf of another Controller, Locktera acts as a Subprocessor, subject to Customer having the necessary authorization to engage Locktera.

Where applicable under the CCPA/CPRA, Customer acts as a Business and Locktera acts as a Service Provider or Contractor, as determined by the parties' actual Processing relationship and applicable law.

This DPA applies solely to Personal Data processed by Locktera on behalf of Customer in its capacity as a Processor or Service Provider and does not apply to data processed by Locktera in its capacity as an independent Controller, if any.

This DPA is incorporated into and forms an integral part of the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

This DPA becomes effective upon execution or acceptance of the Agreement in accordance with its terms and applies to the Processing of Personal Data by Locktera on behalf of Customer for the duration of the applicable Services.

1. DEFINITIONS

For purposes of this Data Processing Addendum (“DPA”), the following terms shall have the meanings set forth below. Capitalized terms not defined herein shall have the meanings given in the Agreement.

1.1 Personal Data

“Personal Data” means any information relating to an identified or identifiable natural person that is Processed by Locktera on behalf of Customer in connection with the Services. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

For purposes of the CCPA and CPRA, “Personal Data” includes “Personal Information” as defined under those laws.

1.2 Data Protection Laws

“Data Protection Laws” means all applicable laws and regulations relating to privacy, data protection, and information security governing the Processing of Personal Data under the Agreement, including, without limitation:

Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”); • The UK GDPR and UK Data Protection Act 2018; • The Swiss Federal Act on Data Protection (“FADP”), where applicable; • The California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”); • Any other applicable federal, state, national, or international privacy or data protection laws and regulations.

1.3 Controller

“Controller” means the entity that alone or jointly with others determines the purposes and means of the Processing of Personal Data. For purposes of this DPA, Customer acts as a Controller where it determines the purposes and means of Processing, or as a Processor where it Processes Personal Data on behalf of another Controller. The parties' respective roles shall be determined by their actual Processing activities and applicable Data Protection Laws.

1.4 Processor

“Processor” means the entity that Processes Personal Data on behalf of a Controller. For purposes of this DPA, Locktera acts as the Processor (or “Service Provider” or “Contractor,” where applicable under CCPA/CPRA).

1.5 Subprocessor

“Subprocessor” means any third-party processor engaged by Locktera to Process Personal Data on behalf of Customer in connection with the Services.

1.6 Processing

“Processing” or “Process” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, restriction, erasure, or destruction.

1.7 Data Subject

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.

1.8 Security Incident

“Security Incident” means any confirmed or reasonably suspected unauthorized access to, acquisition of, disclosure of, alteration of, loss of, or destruction of Personal Data Processed by Locktera on behalf of Customer, or any other event that may constitute a Personal Data Breach under applicable Data Protection Laws.

A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful login attempts, port scans, or other unsuccessful network attacks.

For purposes of notification under Section 7, Locktera shall assess Security Incidents promptly and notify Customer when Locktera becomes aware of a Personal Data Breach affecting Personal Data Processed on Customer's behalf, without waiting for completion of a forensic investigation or final determination of all affected records.

“Personal Data Breach” has the meaning assigned under applicable Data Protection Laws, including Article 4(12) of the GDPR, where applicable..

1.9 Restricted Transfer

“Restricted Transfer” means a transfer of Personal Data that is subject to restrictions under Data Protection Laws, including transfers of Personal Data from the European Economic Area (EEA), Switzerland, or the United Kingdom to a country that has not been recognized as providing an adequate level of data protection by applicable regulators.

1.10 Standard Contractual Clauses (SCCs)

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, as amended, replaced, or superseded from time to time, where applicable to a Restricted Transfer.

For Restricted Transfers subject to United Kingdom Data Protection Laws, the applicable transfer mechanism may include the UK International Data Transfer Addendum to the EU SCCs, the UK International Data Transfer Agreement, or another legally recognized transfer mechanism, as applicable.

For Restricted Transfers subject to Swiss Data Protection Laws, the applicable SCCs shall be interpreted or supplemented as required under Swiss law.

2. ROLES OF THE PARTIES

2.1 Controller and Processor Relationship

The parties acknowledge and agree that, with respect to the Processing of Personal Data under the Agreement:

(a) Customer acts as the Controller where it determines the purposes and means of Processing Personal Data, or as a Processor where it Processes Personal Data on behalf of another Controller and has the necessary authorization to engage Locktera as a Subprocessor;

(b) Locktera acts as a Processor where Customer acts as Controller, or as a Subprocessor where Customer acts as Processor, and Processes Personal Data on behalf of and in accordance with Customer's documented instructions, except as otherwise required by applicable law;

(c) Locktera shall Process Personal Data only for the limited and specific purposes of providing, operating, securing, maintaining, and supporting the Services in accordance with the Agreement, this DPA, and Customer's documented instructions;

(d) Customer retains responsibility for determining the categories of Personal Data submitted to the Services, the lawful purposes of Processing, and the authorization policies governing access to Customer Data; and

(e) Locktera remains responsible for implementing appropriate technical and organizational security measures within the Locktera-managed systems and infrastructure used to provide the Services, as required under this DPA and applicable Data Protection Laws.

Locktera shall not sell Personal Data or share Personal Data for cross-context behavioral advertising and shall not retain, use, or disclose Personal Data for purposes outside the limited and specified purposes permitted under the Agreement and this DPA, except as permitted or required by applicable Data Protection Laws.

Nothing in this Section transfers responsibility for Customer-controlled access policies, Customer-managed infrastructure, or Customer-controlled cryptographic keys to Locktera, except to the extent that Locktera expressly assumes such responsibility in writing or is otherwise responsible under applicable law.

2.2 Customer Processing Instructions

Customer instructs Locktera to Process Personal Data only to the extent necessary to:

(a) provide, operate, and support the Services in accordance with the Agreement;

(b) secure, authenticate, authorize, and enforce access controls for cryptographic containers and protected data in accordance with Customer-defined policies;

(c) maintain, monitor, troubleshoot, and improve the reliability, integrity, performance, and security of the Services, provided that such Processing remains consistent with the purposes authorized under this DPA;

(d) comply with applicable law, legal process, or binding governmental requests, subject to applicable notification requirements; and

(e) perform other Processing activities authorized by Customer through its configuration and use of the Services or through additional documented instructions.

Customer may provide additional documented instructions consistent with the Agreement and applicable Data Protection Laws.

Where additional instructions require material changes to the Services, custom development, or processing activities outside the agreed scope, the parties shall mutually agree in writing upon any necessary changes to scope, fees, implementation requirements, or other applicable terms before Locktera is required to implement such instructions, except to the extent otherwise required by applicable law.

Locktera shall promptly inform Customer if, in Locktera's reasonable opinion, an instruction infringes applicable Data Protection Laws, unless prohibited from doing so by law.

Locktera shall not be required to implement an instruction that would compromise the security or integrity of the Services or the Personal Data of other customers, except to the extent required by applicable law.

2.3 Locktera Processing Limitations

Locktera shall not:

(a) determine the purposes of Processing Personal Data on behalf of Customer, except where Locktera acts as an independent Controller for separate processing activities permitted under applicable Data Protection Laws;

(b) access, use, or disclose Personal Data except as necessary to provide, operate, secure, maintain, or support the Services in accordance with Customer's documented instructions, or as otherwise permitted or required by applicable law;

(c) access Personal Data except through authorized and controlled mechanisms necessary for service operation, security, maintenance, support, or compliance with applicable legal obligations;

(d) sell Personal Data or share Personal Data for cross-context behavioral advertising; or

(e) Process Personal Data for Locktera's independent commercial purposes outside the scope of the Agreement and this DPA, except where expressly permitted under applicable Data Protection Laws.

Locktera shall not retain, use, or disclose Personal Data outside the direct business relationship between Locktera and Customer except as permitted under applicable Data Protection Laws.

Customer acknowledges that Locktera's cryptographic container architecture is designed to enforce Customer-defined authorization policies and access controls.

Customer is responsible for determining which users, systems, devices, and third parties are authorized to access Personal Data and for configuring the applicable authorization policies.

Locktera does not independently determine Customer authorization policies or grant access to Customer Data contrary to such policies, except as authorized by Customer or required by applicable law.

Locktera remains responsible for the security and proper operation of Locktera-managed components, including the implementation of applicable technical and organizational measures required by this DPA.

Where Customer maintains control of encryption keys, storage infrastructure, authentication credentials, or access configurations, Customer remains responsible for the security and administration of those Customer-controlled components.

Nothing in this Section limits Locktera's obligations under applicable Data Protection Laws or its express contractual responsibilities under this DPA.

2.4 Customer Responsibilities as Controller

Customer is solely responsible for:

(a) determining whether Personal Data is submitted to, encrypted within, or processed using the Services;

(b) determining the categories and types of Personal Data processed;

(d) determining which users, systems, or third parties are authorized to access Personal Data;

(e) configuring authorization policies, access controls, and permissions governing Personal Data; and

(f) ensuring that Customer’s Processing of Personal Data complies with applicable Data Protection Laws.

Customer represents and warrants that it has obtained all necessary rights, permissions, and lawful bases required to Process Personal Data and to instruct Locktera to Process Personal Data on Customer’s behalf.

3. PROCESSING OF PERSONAL DATA

3.1 Processing Scope and Instructions

Locktera shall Process Personal Data on behalf of Customer only in accordance with:

(a) Customer's documented instructions, including the Agreement, this DPA, applicable Order Forms, and Customer's configuration and use of the Services;

(b) the limited and specified purposes of providing, operating, securing, maintaining, monitoring, and supporting the Services;

(d) applicable legal obligations, including lawful and binding requests from governmental authorities, provided that Locktera shall, unless prohibited by law, notify Customer before disclosing Personal Data and provide reasonable assistance to enable Customer to challenge or limit such disclosure where permitted by law.

Customer's documented instructions include instructions provided through authorized users, API integrations, SDK configurations, administrative settings, access policies, and other supported Service functionality.

Locktera shall not Process Personal Data for purposes unrelated to the Services or outside Customer's documented instructions, except as required by applicable law.

Where Locktera is required by applicable law to Process Personal Data contrary to Customer's documented instructions, Locktera shall inform Customer of that legal requirement before Processing, unless applicable law prohibits such notification.

3.2 Processing Limitations

Locktera shall not, and shall ensure that personnel and Subprocessors acting on its behalf do not:

(a) sell Personal Data;

(b) share Personal Data for cross-context behavioral advertising;

(c) retain, use, or disclose Personal Data outside the direct business relationship between Locktera and Customer, except as permitted or required by applicable Data Protection Laws;

(d) retain Personal Data longer than necessary to provide the Services, fulfill Customer's documented instructions, or comply with applicable legal obligations, subject to Section 9 of this DPA;

(e) Process Personal Data for Locktera's independent commercial purposes outside the scope of the Agreement and this DPA; or

(f) combine Personal Data received from Customer with Personal Data obtained from other sources, except as necessary to provide the Services or as otherwise permitted under applicable Data Protection Laws.

Locktera may Process operational metadata, authentication records, authorization information, audit logs, service telemetry, and other information necessary to operate, secure, maintain, support, and improve the reliability of the Services, provided such Processing is consistent with the purposes authorized under this DPA.

To the extent such information constitutes Personal Data Processed on behalf of Customer, it shall remain subject to this DPA.

For purposes of the CCPA and CPRA, Locktera acts as a Service Provider or Contractor when Processing Personal Data on behalf of Customer, as applicable.

3.3 Limited Access to Personal Data

Locktera shall limit access to Personal Data Processed on behalf of Customer to the extent reasonably necessary to:

(a) provide, operate, maintain, and support the Services;

(b) authenticate users, evaluate authorization requests, and enforce Customer-defined access controls;

(d) detect, investigate, contain, and respond to Security Incidents;

(e) provide Customer-requested technical support and troubleshooting; and

(f) comply with applicable legal obligations.

Access to Personal Data by Locktera personnel shall be limited to authorized personnel with a legitimate operational need and shall be subject to appropriate confidentiality obligations and technical and organizational security measures.

Customer acknowledges that the Services may Process encrypted Customer Data without requiring Locktera personnel to access or inspect the underlying plaintext content.

Locktera shall not be required to decrypt, inspect, classify, or otherwise access the plaintext contents of encrypted Customer Data except where technically necessary for an expressly authorized Service function, permitted by Customer's documented instructions, or required by applicable law.

Locktera shall implement appropriate controls designed to prevent unauthorized access to Personal Data within Locktera-managed systems and infrastructure.

3.4 Cryptographic Enforcement and Customer Control

Customer acknowledges that:

(a) Locktera's Services utilize cryptographic container technology and related security mechanisms designed to protect Customer Data and enforce applicable authorization policies;

(b) Customer determines and configures the access permissions, recipient authorizations, and applicable security policies governing Customer Data through the functionality made available by the Services;

(c) Locktera enforces Customer-defined authorization policies through Locktera-managed components, APIs, SDKs, and other applicable Service functionality;

(d) Customer remains responsible for the accuracy, appropriateness, and administration of Customer-defined authorization policies, including decisions concerning which users, devices, applications, and third parties are authorized to access Customer Data;

(e) the allocation of responsibility for encryption keys, key management, storage infrastructure, authentication mechanisms, and related security functions depends on the Services purchased and the applicable deployment configuration; and

(f) where Customer manages encryption keys, storage infrastructure, or other security components, Customer is responsible for administering and protecting those Customer-controlled components.

Locktera shall remain responsible for implementing appropriate technical and organizational measures within Locktera-managed systems and for operating the security enforcement functionality expressly provided as part of the Services.

Customer acknowledges that Locktera does not independently determine the content, sensitivity, classification, or lawful purpose of Personal Data submitted by Customer.

Locktera shall not be responsible for unauthorized access resulting solely from Customer's authorization decisions, misconfigurations, or failure to protect Customer-controlled credentials or cryptographic keys, except to the extent such unauthorized access is caused or contributed to by Locktera's breach of this DPA or applicable law.

Nothing in this Section relieves either party of responsibilities imposed upon it under applicable Data Protection Laws.

3.5 Compliance with Customer Instructions

Locktera shall promptly notify Customer if, in Locktera’s reasonable opinion, Customer’s instructions violate applicable Data Protection Laws.

3.6 GDPR Article 28 Compliance

To the extent the GDPR or UK GDPR applies to the Processing of Personal Data under the Agreement, the parties intend this DPA to satisfy the requirements of Article 28(3) of the GDPR and UK GDPR.

Locktera shall:

(a) Process Personal Data only on documented instructions from Customer, including with respect to transfers of Personal Data to third countries or international organizations, unless otherwise required by applicable law;

(b) ensure that personnel authorized to Process Personal Data are subject to appropriate confidentiality obligations;

(c) implement appropriate technical and organizational security measures in accordance with Article 32 of the GDPR and Section 5 of this DPA;

(d) engage Subprocessors only in accordance with Article 28(2) and 28(4) of the GDPR and Section 6 of this DPA;

(e) taking into account the nature of the Processing, assist Customer through appropriate technical and organizational measures, insofar as reasonably possible, in fulfilling Customer's obligations to respond to Data Subject requests;

(f) taking into account the nature of the Processing and the information available to Locktera, assist Customer in ensuring compliance with applicable obligations under Articles 32 through 36 of the GDPR;

(g) at Customer's choice, delete or return Personal Data upon termination or expiration of the applicable Services, subject to applicable legal retention requirements and Section 9 of this DPA;

(h) make available information necessary to demonstrate compliance with the obligations imposed upon Locktera under Article 28 of the GDPR and permit and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to reasonable confidentiality, security, and operational safeguards consistent with applicable law; and

(i) promptly inform Customer if, in Locktera's opinion, a documented instruction infringes the GDPR or other applicable Data Protection Laws.

Where Customer acts as a Processor on behalf of another Controller, the parties shall apply the relevant obligations under this DPA to the extent required by applicable Data Protection Laws and Customer's lawful instructions.

Nothing in this Section shall be interpreted to waive or limit mandatory rights or obligations arising under applicable Data Protection Laws.

3.7 Nature, Purpose, and Duration of Processing

Subject Matter of Processing:

Personal Data Processed in connection with Customer's use of the Services, including encrypted Customer Data and associated operational, authentication, authorization, and audit information.

Nature of Processing:

Encryption, encrypted storage and transmission, authentication, authorization evaluation, access control enforcement, cryptographic container management, logging, monitoring, security operations, and related data management activities, as applicable to the Services purchased and the deployment configuration.

Purpose of Processing:

To provide, operate, secure, maintain, and support the Services in accordance with the Agreement, this DPA, and Customer's documented instructions.

Duration of Processing:

For the duration of the Agreement or applicable Services and thereafter only as necessary to complete authorized deletion or return procedures, comply with applicable legal obligations, or retain information as otherwise permitted under this DPA and applicable Data Protection Laws.

Categories of Data Subjects:

Customer employees, contractors, authorized users, customers, business contacts, end users, and other individuals whose Personal Data is submitted to or Processed through the Services by or on behalf of Customer.

Categories of Personal Data:

Personal Data submitted or made available by Customer, which may include names, contact information, account identifiers, user identifiers, authentication information, device identifiers, IP addresses, access records, audit information, and other information contained in Customer Data.

The specific categories of Personal Data depend on Customer's use of the Services and the applicable deployment configuration.

Sensitive Personal Data:

Customer may submit Personal Data that qualifies as sensitive or special-category data under applicable Data Protection Laws, subject to the Agreement, applicable legal requirements, and any additional safeguards expressly agreed between the parties.

Processing Operations and Infrastructure:

Processing may occur through Locktera-managed infrastructure, Customer-controlled infrastructure, or supported third-party services, depending on the Services purchased and the applicable deployment configuration.

The parties acknowledge that Locktera's access to plaintext Customer Data may be technically restricted by the encryption architecture, key-management configuration, and Customer-controlled authorization policies applicable to the Services.

4. CUSTOMER OBLIGATIONS

4.1 Customer Responsibility as Controller

Customer represents, warrants, and agrees that, with respect to Personal Data Processed on its behalf in connection with the Services:

(a) Customer has the necessary rights, authority, and lawful bases to collect, use, disclose, and otherwise Process Personal Data and to authorize Locktera to Process such Personal Data in accordance with the Agreement and this DPA;

(b) Customer has provided all notices and obtained all consents, permissions, and authorizations required under applicable Data Protection Laws;

(c) Customer's Processing of Personal Data, including its purposes, lawful bases, and documented instructions to Locktera, complies with applicable Data Protection Laws;

(d) Customer shall not instruct Locktera to Process Personal Data in violation of applicable Data Protection Laws; and

(e) where Customer acts as a Processor on behalf of another Controller, Customer has the necessary authorization to engage Locktera as a Subprocessor and provide the applicable Processing instructions.

Customer remains responsible for determining the accuracy, quality, legality, and appropriateness of Personal Data submitted to the Services and for establishing the lawful purposes for which such Personal Data is Processed.

Nothing in this Section relieves Locktera of its independent obligations under applicable Data Protection Laws or its express responsibilities under this DPA.

4.2 Access Control and Authorization Responsibilities

Customer acknowledges and agrees that Customer is responsible for:

(a) determining which Personal Data is submitted to, encrypted within, stored through, or otherwise Processed using the Services;

(b) configuring, administering, and maintaining Customer-defined access controls, authorization policies, recipient permissions, and applicable security settings;

(d) managing and protecting authentication credentials, API keys, cryptographic keys, access tokens, and other authorization mechanisms under Customer's control;

(e) promptly modifying or revoking access permissions when users or recipients are no longer authorized; and

(f) ensuring that Customer-defined authorization policies and configurations are appropriate for Customer's intended use of the Services and applicable legal obligations.

Customer acknowledges that Locktera's Services are designed to enforce access authorization through cryptographic and policy-based mechanisms configured by Customer.

Locktera does not independently determine which persons or systems Customer should authorize to access Personal Data.

Locktera remains responsible for the proper operation of Locktera-managed authorization and security enforcement components in accordance with this DPA and applicable Data Protection Laws.

Responsibility for cryptographic key management, authentication systems, and storage infrastructure shall be allocated according to the applicable Services, deployment configuration, and contractual arrangements.

4.3 Security Responsibilities of Customer

Customer shall implement and maintain appropriate administrative, technical, and organizational safeguards designed to protect Personal Data within Customer-controlled systems, infrastructure, and environments, including:

(a) securing Customer-managed applications, networks, storage environments, devices, and infrastructure;

(b) protecting authentication credentials, API keys, cryptographic keys, access tokens, and other security credentials under Customer's control;

(c) implementing appropriate authentication, authorization, and access management procedures for Customer-controlled accounts and systems;

(d) promptly revoking access for terminated, compromised, or unauthorized users;

(e) maintaining appropriate security configurations for Customer-controlled integrations and supported Service functionality; and

(f) promptly notifying Locktera upon becoming aware of suspected unauthorized access, credential compromise, or other security events that may materially affect the Services or Locktera-managed systems.

Customer shall cooperate reasonably with Locktera in investigating and mitigating security events involving Customer-controlled systems or configurations.

To the extent permitted by applicable law, Locktera shall not be responsible for a Security Incident caused solely by Customer-controlled systems, Customer's failure to implement appropriate security safeguards, or Customer's misconfiguration of authorization policies or access controls.

The foregoing exclusion shall not apply to the extent the Security Incident results from Locktera's breach of this DPA, failure to implement required security measures, or other acts or omissions for which Locktera is responsible under applicable law.

Nothing in this Section limits either party's mandatory obligations under applicable Data Protection Laws.

4.4 Compliance with Data Protection Laws

Customer is responsible for:

(a) determining whether the Services and applicable deployment configuration are appropriate for Customer's intended Processing of Personal Data;

(b) complying with legal and regulatory obligations applicable to Customer in its capacity as Controller or, where applicable, as Processor acting on behalf of another Controller;

(d) providing required privacy notices and managing consent requirements where applicable;

(e) receiving, evaluating, and responding to Data Subject requests and regulatory inquiries for which Customer is responsible under applicable Data Protection Laws;

(f) maintaining records of Processing activities and conducting privacy impact assessments where required by applicable law; and

(g) determining whether additional contractual, technical, or organizational safeguards are required for Customer's intended Processing activities.

Locktera shall provide the assistance required of it under this DPA and applicable Data Protection Laws, taking into account the nature of the Processing and the information reasonably available to Locktera.

Nothing in this Section transfers to Customer any statutory responsibility imposed directly upon Locktera as a Processor or Service Provider.

4.5 Customer Instructions

Customer shall ensure that all instructions provided to Locktera comply with applicable Data Protection Laws and the Agreement. Customer shall not provide instructions that would cause Locktera to violate applicable Data Protection Laws.

5. SECURITY MEASURES

5.1 Implementation of Security Measures

Locktera shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data Processed on behalf of Customer against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Such measures shall be appropriate to the nature, scope, context, and purposes of Processing and the risks presented to the rights and freedoms of individuals, taking into account the state of the art, costs of implementation, and applicable Data Protection Laws.

Locktera shall maintain safeguards designed to support the ongoing confidentiality, integrity, availability, and resilience of Locktera-managed systems and Services.

The specific security measures implemented may vary according to the Services purchased, deployment architecture, applicable technical capabilities, and allocation of responsibilities between Locktera and Customer.

Locktera shall remain responsible for implementing appropriate security measures within systems and infrastructure under its control.

Customer remains responsible for security measures applicable to Customer-controlled systems, storage environments, cryptographic keys, credentials, and authorization configurations, as further described in Sections 3 and 4 of this DPA.

Nothing in this Section limits either party's mandatory security obligations under applicable Data Protection Laws.

5.2 Technical Safeguards

Locktera shall implement and maintain appropriate technical security measures for Locktera-managed systems and Services, taking into account the nature of the Processing, applicable risks, and the Services and deployment configuration.

Such measures shall include, as applicable:

(a) encryption of Personal Data in transit using industry-standard cryptographic protocols;

(b) encryption of Personal Data at rest using appropriate cryptographic mechanisms;

(d) secure cryptographic key generation, storage, access restriction, rotation, and management procedures for cryptographic keys managed by Locktera;

(e) access control mechanisms designed to restrict access to authorized personnel, applications, and systems;

(f) authentication and authorization mechanisms designed to verify identity and evaluate access permissions before granting access to protected resources;

(g) operational logging, audit logging, monitoring, and security event detection mechanisms appropriate to the Services;

(h) network security measures, including firewalls, network segmentation, and access restrictions where applicable;

(i) infrastructure security measures designed to protect Locktera-managed systems against unauthorized access, compromise, and material security threats;

(j) vulnerability management, security patching, and remediation procedures designed to identify and address security vulnerabilities according to their severity and operational risk; and

(k) appropriate backup, recovery, and service continuity safeguards for applicable Locktera-managed production systems.

The implementation and configuration of individual measures may vary according to the applicable Services, infrastructure architecture, and technical requirements.

Where cryptographic keys, storage infrastructure, authentication systems, or other security components are managed by Customer, Customer shall be responsible for implementing and maintaining appropriate security measures for those components.

Locktera may update, replace, or enhance individual security technologies and controls, provided that such changes do not materially diminish the overall level of security required under this DPA or applicable Data Protection Laws.

The technical and organizational measures described in Annex II shall supplement this Section, subject to the applicable Services and deployment configuration.

5.3 Organizational Safeguards

Locktera shall implement and maintain appropriate organizational security measures designed to protect Personal Data Processed on behalf of Customer, including:

(a) restricting access to Personal Data and Locktera-managed systems to authorized personnel with a legitimate operational or business need, consistent with the principle of least privilege;

(b) ensuring personnel authorized to Process Personal Data are subject to appropriate contractual, statutory, or other legally enforceable confidentiality obligations;

(c) maintaining internal security policies and procedures governing access to systems, protection of Personal Data, and management of security risks;

(d) maintaining procedures designed to identify, investigate, contain, mitigate, and respond to Security Incidents;

(e) implementing reasonable personnel security, access management, and security awareness practices appropriate to personnel responsibilities;

(f) periodically reviewing and updating applicable security policies, access permissions, and operational security procedures based on identified risks and changes to the Services; and

(g) implementing appropriate oversight of Subprocessors in accordance with Section 6 of this DPA.

Locktera may adapt its organizational security practices to reflect changes in its operations, personnel, infrastructure, and security requirements, provided that such changes do not materially diminish the overall protection of Personal Data required under this DPA.

5.4 Cryptographic Enforcement Architecture

Customer acknowledges that Locktera's Services utilize cryptographic container architecture and related security mechanisms designed to protect Customer Data and enforce applicable authorization policies.

Locktera's security architecture is designed to provide persistent protection of Customer Data through encryption, cryptographic authorization, and policy-based access controls, as applicable to the Services purchased.

Customer determines and configures the access permissions, recipient authorizations, and security policies governing Customer Data through supported Service functionality.

Locktera-managed authorization systems are designed to evaluate and enforce applicable Customer-defined policies before permitting authorized access to protected content.

Locktera does not independently determine which users, systems, or recipients Customer should authorize to access Personal Data.

Locktera shall not access or decrypt Personal Data except as authorized through Customer's documented instructions, as necessary to provide the Services, or as required by applicable law.

The allocation of responsibilities for cryptographic key management, encryption operations, authorization enforcement, and storage infrastructure shall depend on the applicable Services and deployment configuration.

Nothing in this Section relieves Locktera of responsibility for implementing and maintaining appropriate security controls within Locktera-managed systems or for operating the security functionality expressly provided as part of the Services.

5.5 Customer Security Responsibilities

Customer acknowledges and agrees that Customer is responsible for:

(a) configuring and maintaining Customer-defined authorization policies, access permissions, and applicable security settings;

(b) managing and protecting authentication credentials, API keys, cryptographic keys, access tokens, and other security credentials under Customer's control;

(d) securing Customer-controlled applications, networks, devices, storage environments, and infrastructure;

(e) promptly modifying or revoking access permissions when users or recipients are no longer authorized; and

(f) implementing appropriate safeguards for Customer-controlled integrations and deployment configurations.

To the extent permitted by applicable law, Locktera shall not be responsible for a Security Incident caused solely by Customer's failure to implement appropriate security measures or by Customer's misconfiguration of authorization policies, access controls, credentials, or Customer-controlled infrastructure.

This limitation shall not apply to the extent a Security Incident results from Locktera's breach of this DPA, failure to implement required security measures, or other acts or omissions for which Locktera is responsible under applicable law.

Nothing in this Section limits Locktera's express security obligations under this DPA.

5.6 Security Measure Evolution

Locktera may modify, replace, update, or enhance its technical and organizational security measures to reflect changes in technology, infrastructure, security threats, operational requirements, or applicable law.

Such modifications shall not materially diminish the overall level of security provided for Personal Data Processed on behalf of Customer, taking into account the nature of the Services, applicable risks, and the requirements of applicable Data Protection Laws.

Locktera shall not be required to maintain any particular technology, security product, infrastructure provider, or implementation method where an alternative measure provides an appropriate level of protection consistent with this DPA.

Any material changes to security measures that affect express contractual commitments shall be handled in accordance with the Agreement and applicable Data Protection Laws.

5.7 Customer-Controlled Cryptographic Protection

Customer acknowledges that Locktera's cryptographic container architecture enables Customer to configure and control authorization policies and applicable security settings governing access to Customer Data.

Depending on the Services purchased and the applicable deployment configuration, Customer may retain control over cryptographic keys, storage environments, recipient permissions, authentication mechanisms, and other security functions.

Locktera shall enforce applicable Customer-defined authorization policies through the security functionality provided as part of the Services.

Locktera does not independently determine which persons, devices, applications, or systems Customer should authorize to access Personal Data.

Customer remains responsible for the selection, configuration, administration, and maintenance of Customer-controlled security policies, credentials, cryptographic keys, and infrastructure.

Locktera remains responsible for the security and proper operation of Locktera-managed authorization, cryptographic enforcement, and supporting service components in accordance with this DPA.

Nothing in this Section shall be interpreted as transferring responsibility for Customer-controlled security decisions to Locktera or relieving Locktera of its express obligations under this DPA and applicable Data Protection Laws.

6. SUBPROCESSORS

6.1 General Authorization

Customer provides general written authorization for Locktera to engage Subprocessors to Process Personal Data on Customer's behalf in connection with the provision, operation, security, maintenance, and support of the Services, subject to the requirements of this Section 6.

Such authorization includes Subprocessors identified in the Subprocessor list maintained by Locktera and additional Subprocessors engaged in accordance with the notice and objection procedures set forth in this DPA.

Locktera shall remain responsible for selecting and managing its Subprocessors in accordance with applicable Data Protection Laws.

Customer acknowledges that the Services may depend on third-party infrastructure, hosting, cloud services, security services, and other technology providers engaged by Locktera.

Nothing in this Section authorizes Locktera to engage Subprocessors for purposes unrelated to the Services or otherwise prohibited by applicable Data Protection Laws.

6.2 Subprocessor Obligations

Locktera shall ensure that each Subprocessor engaged to Process Personal Data on behalf of Customer is subject to a written agreement that:

(a) imposes data protection obligations that provide a level of protection substantially equivalent to the obligations applicable to Locktera under this DPA, to the extent relevant to the Processing performed by the Subprocessor and as required by applicable Data Protection Laws;

(b) requires the Subprocessor to maintain appropriate confidentiality obligations;

(c) requires the Subprocessor to implement appropriate technical and organizational security measures designed to protect Personal Data;

(d) limits the Subprocessor's Processing of Personal Data to the purposes necessary to provide the applicable services to Locktera and in accordance with Locktera's documented instructions;

(e) requires the Subprocessor to provide reasonable assistance to Locktera in fulfilling applicable data protection obligations, including Security Incident response and Data Subject rights assistance, where required by applicable Data Protection Laws; and

(f) requires appropriate safeguards for international transfers of Personal Data where applicable.

Locktera shall exercise reasonable oversight of its Subprocessors in accordance with the nature of the services provided, the risks associated with the Processing, and applicable Data Protection Laws.

Nothing in this Section requires Locktera to disclose confidential commercial terms of its agreements with Subprocessors, except to the extent disclosure is required by applicable law.

6.3 Locktera Responsibility

Locktera shall remain responsible to Customer for the performance of its Subprocessors' data protection obligations under this DPA to the extent required by applicable Data Protection Laws.

Where a Subprocessor fails to fulfill its applicable data protection obligations, Locktera shall remain liable to Customer for the performance of those obligations as required under Article 28(4) of the GDPR or other applicable Data Protection Laws.

Such responsibility shall be subject to the applicable limitations of liability set forth in the Agreement, except to the extent such limitations are prohibited by applicable law or conflict with mandatory provisions of applicable Standard Contractual Clauses.

Locktera shall not be responsible under this Section for the acts or omissions of third-party service providers independently selected, contracted, or controlled by Customer and not engaged by Locktera as Subprocessors.

Nothing in this Section limits any mandatory statutory liability applicable to Locktera or the rights of Data Subjects under applicable Data Protection Laws.

6.4 Subprocessor List and Updates

Locktera shall maintain a current list of Subprocessors authorized to Process Personal Data on behalf of Customer in connection with the Services.

The list shall be made available through Locktera's designated Subprocessor webpage or upon Customer's written request and shall identify the Subprocessors and their relevant Processing functions.

Locktera shall provide Customer with at least thirty (30) days' prior notice before authorizing a new Subprocessor to Process Personal Data on Customer's behalf, except where an earlier engagement is reasonably necessary to address an urgent security, availability, or legal requirement.

Notice may be provided through email, the Services interface, a subscription-based notification mechanism, or another agreed written communication method.

Where urgent circumstances require shorter notice, Locktera shall notify Customer as soon as reasonably practicable and explain the circumstances requiring expedited engagement.

Customer shall be responsible for maintaining current administrative contact information and, where applicable, subscribing to designated Subprocessor change notifications.

The engagement of a new Subprocessor shall remain subject to Customer's objection rights under Section 6.5 and applicable Data Protection Laws.

6.5 Customer Objection Rights

Customer may object to the engagement of a new Subprocessor on reasonable grounds relating to the protection of Personal Data or Customer's compliance with applicable Data Protection Laws.

Customer shall submit any objection in writing within thirty (30) days after receiving notice of the proposed Subprocessor engagement, identifying the specific data protection concerns forming the basis of the objection.

The parties shall work in good faith to address a timely and reasonable objection, which may include providing additional information regarding applicable safeguards, implementing commercially reasonable mitigation measures, or considering an alternative Processing arrangement where technically and commercially feasible.

If the parties are unable to resolve the objection within a reasonable period, Customer may terminate the affected portion of the Services by providing written notice to Locktera, without an early termination penalty attributable solely to such termination.

Any refund of prepaid fees for the terminated portion of the Services shall be determined in accordance with the Agreement, except where applicable Data Protection Laws require otherwise.

An objection shall not automatically require Locktera to discontinue the use of a Subprocessor for other customers or materially redesign the Services.

Locktera shall not proceed with the disputed Processing of Customer's Personal Data through the proposed Subprocessor where doing so would violate applicable Data Protection Laws or Customer's rights under this Section.

6.6 Cross-Border Transfers by Subprocessors

Where a Subprocessor Processes Personal Data in a jurisdiction outside the European Economic Area, United Kingdom, Switzerland, or another jurisdiction subject to applicable international data transfer restrictions, Locktera shall ensure that the transfer complies with applicable Data Protection Laws.

Where a Restricted Transfer requires an appropriate transfer mechanism, Locktera shall implement or ensure the implementation of applicable safeguards, which may include:

(a) Standard Contractual Clauses approved by the European Commission, where applicable;

(b) the UK International Data Transfer Addendum, UK International Data Transfer Agreement, or another valid transfer mechanism recognized under UK Data Protection Laws;

(d) an applicable adequacy decision; or

(e) another legally recognized transfer mechanism permitted under applicable Data Protection Laws.

Where required by applicable law, Locktera shall conduct or obtain an appropriate assessment of the transfer and implement supplementary technical, contractual, or organizational measures necessary to provide the legally required level of protection.

Customer acknowledges that encryption, cryptographic access controls, and Customer-controlled key-management arrangements may contribute to the protection of Personal Data during international transfers, but do not independently eliminate the need for an applicable lawful transfer mechanism.

The parties' respective obligations concerning Restricted Transfers shall be further governed by Section 10 and any applicable Standard Contractual Clauses incorporated into this DPA.

Nothing in this Section authorizes a transfer prohibited by applicable Data Protection Laws.

7. SECURITY INCIDENT NOTIFICATION

7.1 Notification Obligation

Locktera shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed by Locktera on behalf of Customer.

For purposes of this Section, “Personal Data Breach” has the meaning set forth in Section 1.8 of this DPA and applicable Data Protection Laws.

Locktera shall promptly assess reasonably suspected Security Incidents to determine whether a Personal Data Breach has occurred.

Locktera shall not delay notification solely because an investigation remains ongoing or because the full nature, scope, or consequences of the Personal Data Breach have not yet been determined.

Notification shall be provided through reasonable written means, including email to Customer's designated administrative or security contact, the Services interface, or another agreed communication method.

Locktera shall provide information as it becomes reasonably available and may supplement its initial notification with additional findings.

Unsuccessful attempts or activities that do not compromise Personal Data, including unsuccessful login attempts, port scans, and other unsuccessful network attacks, shall not independently trigger notification under this Section, unless notification is otherwise required by applicable law.

Nothing in this Section limits notification obligations imposed by applicable Data Protection Laws or applicable Standard Contractual Clauses.

7.2 Incident Notification Content

To the extent reasonably available at the time of notification, Locktera shall provide Customer with information relevant to the Personal Data Breach, which may include:

(a) a description of the nature of the Personal Data Breach, including the affected systems or Services, where known;

(b) the categories and approximate number of affected Data Subjects and Personal Data records, where such information can reasonably be determined;

(d) the measures taken or proposed by Locktera to contain, investigate, remediate, and mitigate the Personal Data Breach;

(e) reasonable recommendations regarding steps Customer may take to mitigate potential adverse effects; and

(f) contact information for an appropriate Locktera representative responsible for coordinating incident-related communications.

Locktera may provide the required information in phases as additional information becomes available.

Customer acknowledges that Locktera's cryptographic architecture and Customer-controlled encryption keys, storage environments, and authorization configurations may limit Locktera's ability to determine the specific contents, categories, or number of Personal Data records affected.

Locktera shall not be required to access or decrypt Customer Data solely to determine the contents of affected Personal Data where doing so is technically infeasible or would be inconsistent with Customer's documented instructions, except as otherwise required by applicable law.

Locktera shall provide reasonable updates concerning material developments in the investigation and remediation of the Personal Data Breach, taking into account the information available to Locktera and its obligations under applicable Data Protection Laws.

7.3 Incident Response and Mitigation

Upon becoming aware of a Security Incident affecting Personal Data Processed on behalf of Customer, Locktera shall take appropriate and commercially reasonable measures, consistent with applicable Data Protection Laws, to:

(a) investigate the nature, scope, and potential impact of the Security Incident;

(b) contain the Security Incident and mitigate reasonably foreseeable adverse effects;

(c) identify and address vulnerabilities or control failures within Locktera-managed systems that materially contributed to the Security Incident;

(d) restore the security and integrity of affected Locktera-managed systems and Services, as appropriate; and

(e) implement reasonable corrective measures designed to reduce the likelihood of recurrence.

Locktera shall provide reasonable cooperation and assistance to Customer in connection with Customer's investigation, risk assessment, and compliance obligations arising from a Personal Data Breach.

Such assistance shall take into account the nature of the Processing, the information reasonably available to Locktera, the applicable Services, and the parties' respective responsibilities under this DPA.

Customer shall remain responsible for investigating and remediating vulnerabilities or security failures within Customer-controlled systems, infrastructure, credentials, cryptographic keys, and authorization configurations.

Nothing in this Section requires Locktera to provide unrestricted access to its production systems, confidential security architecture, proprietary source code, or information relating to other customers, except to the extent required by applicable law.

7.4 Confidentiality and Security of Incident Information

Information exchanged between the parties concerning a Security Incident or Personal Data Breach shall be treated as Confidential Information under the Agreement, except to the extent disclosure is required by applicable law.

Locktera may withhold, redact, or provide an appropriate summary of information where disclosure would reasonably:

(a) compromise the security or integrity of Locktera-managed systems or Services;

(b) expose confidential information or Personal Data belonging to other customers;

(c) disclose proprietary security architecture, confidential source code, or sensitive vulnerability information in a manner that would create a material security risk;

(d) compromise an ongoing investigation or remediation effort; or

(e) violate applicable law or legally protected confidentiality obligations.

Where information is withheld or redacted, Locktera shall provide a reasonable alternative description or summary to the extent necessary to satisfy its obligations under applicable Data Protection Laws.

Nothing in this Section restricts Customer from making disclosures required by applicable Data Protection Laws, including notifications to supervisory authorities or affected Data Subjects, or limits mandatory disclosure obligations under applicable Standard Contractual Clauses.

7.5 Customer Responsibilities

Customer, in its capacity as Controller or, where applicable, as Processor acting on behalf of another Controller, shall be responsible for determining and fulfilling the breach notification obligations applicable to Customer under relevant Data Protection Laws.

Such responsibilities may include:

(a) evaluating the risks posed by a Personal Data Breach to affected individuals;

(b) determining whether notification to a supervisory authority, regulatory agency, other Controller, or affected Data Subjects is required;

(d) maintaining records of Personal Data Breaches as required by applicable law; and

(e) implementing appropriate remediation measures within Customer-controlled systems and environments.

Locktera shall provide reasonable assistance and information necessary for Customer to fulfill applicable breach notification obligations, taking into account the nature of the Processing and the information reasonably available to Locktera.

Customer shall not be required to obtain Locktera's approval before making a disclosure required by applicable law.

Nothing in this Section relieves Locktera of any independent reporting, notification, cooperation, or recordkeeping obligations imposed directly upon Locktera by applicable Data Protection Laws.

7.6 Exclusions

To the extent permitted by applicable law, Locktera shall not be responsible for a Security Incident or Personal Data Breach caused solely by:

(a) Customer-controlled systems, infrastructure, applications, storage environments, or third-party services not engaged by Locktera as Subprocessors;

(b) Customer's failure to configure or maintain appropriate authorization policies, access controls, or security settings;

(c) compromise, loss, misuse, or unauthorized disclosure of authentication credentials, API keys, cryptographic keys, or access tokens under Customer's control; or

(d) acts or omissions of Customer, its authorized users, or third parties acting under Customer's direction.

The foregoing exclusions shall not apply to the extent a Security Incident or Personal Data Breach results from Locktera's breach of this DPA, failure to implement required security measures, or acts or omissions for which Locktera is responsible under applicable law.

The allocation of responsibility under this Section shall not eliminate or delay any notification, assistance, or cooperation obligation that applies to Locktera under this DPA or applicable Data Protection Laws.

Nothing in this Section limits mandatory statutory rights or obligations or modifies any applicable Standard Contractual Clauses.

8. DATA SUBJECT RIGHTS

8.1 Assistance with Data Subject Requests

Taking into account the nature of the Processing and the functionality of the Services, Locktera shall provide Customer with reasonable assistance, through appropriate technical and organizational measures, insofar as reasonably possible and as required by applicable Data Protection Laws, to enable Customer to fulfill its obligations to respond to requests from Data Subjects.

Such assistance may include supporting Customer in responding to requests concerning:

(a) access to Personal Data;

(b) correction or rectification of inaccurate Personal Data;

(d) restriction of or objection to Processing;

(e) portability of Personal Data, where applicable; and

(f) other rights afforded to Data Subjects under applicable Data Protection Laws.

Where the Services provide functionality enabling Customer to respond directly to Data Subject requests, Customer shall ordinarily use such functionality in the first instance.

Where additional assistance from Locktera is required, Customer shall submit a written request identifying the assistance sought and providing information reasonably necessary for Locktera to evaluate and respond to the request.

Locktera's assistance obligations shall apply to Personal Data Processed by Locktera on behalf of Customer and shall be subject to the requirements of applicable Data Protection Laws.

8.2 Customer Responsibility for Data Subject Requests

Customer, acting as Controller or, where applicable, as Processor on behalf of another Controller, shall be responsible for managing Data Subject requests in accordance with its obligations under applicable Data Protection Laws.

Customer's responsibilities include:

(a) receiving and evaluating Data Subject requests;

(b) verifying the identity and authority of individuals submitting requests;

(d) determining the appropriate response to the request;

(e) communicating with Data Subjects or the applicable Controller; and

(f) complying with applicable statutory response deadlines.

Locktera shall not independently determine whether Customer is legally required to grant or deny a Data Subject request.

Locktera shall not respond directly to Data Subject requests concerning Personal Data Processed on behalf of Customer except as instructed by Customer or required by applicable law.

Nothing in this Section limits Locktera's independent obligations under applicable Data Protection Laws.

8.3 Locktera Processing Limitations and Technical Scope

Customer acknowledges that Locktera's Services utilize cryptographic container technology, encryption, authorization controls, and related security mechanisms designed to protect Customer Data.

Depending on the Services purchased and the applicable deployment configuration, Locktera may not possess the cryptographic keys, authorization credentials, or technical ability necessary to access or decrypt the plaintext contents of Customer Data.

Customer remains responsible for determining the categories of Personal Data submitted to the Services, identifying relevant Data Subjects within Customer-controlled content, and configuring applicable access and authorization policies.

Locktera's ability to identify, retrieve, correct, export, or delete particular Personal Data may depend on:

(a) the functionality available within the applicable Services;

(b) whether the relevant Personal Data is maintained in Locktera-managed or Customer-controlled infrastructure;

(d) Customer's configuration and administration of the Services; and

(e) the technical nature of the Personal Data and Processing operations involved.

Locktera shall not be required to circumvent encryption, defeat security controls, or obtain unauthorized access to Customer Data in order to assist with a Data Subject request.

Where direct access to Personal Data is technically unavailable to Locktera, the parties shall cooperate, as reasonably necessary and required by applicable Data Protection Laws, to identify alternative means of fulfilling the request through Customer-controlled systems or available Service functionality.

Nothing in this Section limits Locktera's obligation to provide assistance required under applicable Data Protection Laws.

8.4 Cooperation and Reasonable Assistance

Locktera shall provide reasonable assistance to Customer in fulfilling applicable Data Subject rights obligations, taking into account:

(a) the nature and scope of the Processing;

(b) the technical functionality and architecture of the Services;

(d) the parties' respective responsibilities under this DPA; and

(e) applicable Data Protection Laws.

Where assistance can be provided through existing Service functionality or standard support procedures, Locktera shall make such assistance available in accordance with the Agreement.

Where Customer requests assistance requiring material custom development, extraordinary engineering work, or substantial operational or administrative resources beyond the standard scope of the Services, the parties may agree in writing upon reasonable fees, scope, and implementation arrangements, to the extent permitted by applicable Data Protection Laws.

Locktera shall not condition or delay assistance that it is legally required to provide upon Customer's acceptance of additional fees or commercial terms.

Customer shall provide information and cooperation reasonably necessary for Locktera to evaluate and fulfill an assistance request.

Nothing in this Section requires Locktera to disclose Personal Data belonging to other customers, compromise the security of the Services, or provide access to proprietary source code, except as required by applicable law.

8.5 Legal Requests

If Locktera receives a request directly from a Data Subject concerning Personal Data Processed on behalf of Customer, Locktera shall, where legally permitted, promptly notify Customer and refer the request to Customer for evaluation and response.

Locktera shall not independently respond to such requests or disclose Personal Data in response to them except:

(a) as instructed or authorized by Customer;

(b) where required by applicable law; or

(c) where necessary to comply with a binding order or lawful requirement of a competent governmental or judicial authority.

Where Locktera is legally required to respond directly to a request or disclose Personal Data, Locktera shall, unless prohibited by applicable law, notify Customer before responding or disclosing the information.

Locktera shall disclose only the Personal Data reasonably necessary to comply with the applicable legal requirement, subject to applicable law.

Nothing in this Section requires Locktera to access or decrypt Personal Data that it does not possess or cannot lawfully access.

8.6 Regulatory Cooperation

To the extent required by applicable Data Protection Laws, Locktera shall provide reasonable assistance and cooperation to Customer in responding to lawful requests, inquiries, investigations, or proceedings initiated by competent data protection supervisory authorities relating to Personal Data Processed by Locktera on behalf of Customer.

Such assistance shall take into account the nature of the Processing, the information reasonably available to Locktera, and the respective responsibilities of the parties under this DPA.

Locktera shall provide information reasonably necessary to demonstrate compliance with its obligations under this DPA and applicable Data Protection Laws, subject to appropriate confidentiality, security, and legal safeguards.

Locktera shall not be required to disclose confidential information concerning other customers, privileged legal communications, proprietary source code, or sensitive security information except to the extent disclosure is required by applicable law.

Where disclosure of sensitive information is legally required, the parties shall cooperate, where practicable, to implement appropriate confidentiality and security protections.

Nothing in this Section limits Locktera's independent obligation to cooperate directly with competent supervisory authorities where required by applicable Data Protection Laws or applicable Standard Contractual Clauses.

9. DATA RETENTION AND DELETION

9.1 Retention During Term

Locktera shall retain and Process Personal Data on behalf of Customer only for the duration and purposes necessary to provide the Services, fulfill Customer's documented instructions, and comply with applicable legal obligations.

The applicable retention period may vary according to the nature of the Personal Data, the Services purchased, Customer's configuration of the Services, and applicable legal requirements.

Customer shall remain responsible for determining and configuring retention periods, deletion policies, and access restrictions for Customer-controlled data, storage environments, and cryptographic containers.

Locktera may retain operational records, authentication information, authorization records, audit logs, security logs, and related metadata to the extent necessary to provide, secure, maintain, and support the Services, comply with applicable law, or fulfill legitimate contractual obligations consistent with this DPA.

Such records shall remain subject to appropriate security measures and applicable retention limitations.

Locktera shall not retain Personal Data Processed on behalf of Customer for independent commercial purposes inconsistent with the Agreement, this DPA, or applicable Data Protection Laws.

9.2 Deletion or Return Upon Termination

Upon expiration or termination of the Agreement, Locktera shall, at Customer's choice, return or delete Personal Data Processed on Customer's behalf, in accordance with applicable Data Protection Laws and the terms of this DPA.

Where return of Personal Data is requested, Locktera shall make such Personal Data available through existing Service functionality or another mutually agreed commercially reasonable method, taking into account the applicable deployment architecture and technical capabilities.

Where Customer has elected deletion, or where the applicable return period has expired following a reasonable opportunity for Customer to retrieve its data, Locktera shall delete Personal Data within its possession or control in accordance with its documented deletion procedures, subject to Section 9.3 and applicable legal requirements.

Unless otherwise required by applicable law or expressly agreed in writing, Locktera shall not be obligated to retain Customer Data indefinitely following expiration or termination of the Agreement.

Where applicable law requires retention of Personal Data, Locktera may retain such Personal Data solely to the extent and for the period required by law, subject to appropriate confidentiality and security safeguards.

Locktera shall delete retained Personal Data when the applicable legal retention requirement expires, unless continued retention is otherwise legally required.

Customer acknowledges that Locktera may not possess or control the encrypted content, cryptographic keys, or storage infrastructure necessary to retrieve or delete Personal Data maintained exclusively in Customer-controlled environments.

Nothing in this Section limits Customer's rights or Locktera's obligations under applicable Data Protection Laws or Standard Contractual Clauses.

9.3 Deletion Scope and Limitations

Locktera's deletion obligations shall apply to Personal Data within Locktera's possession or control, subject to applicable Data Protection Laws and the technical characteristics of the Services.

Customer acknowledges that:

(a) Personal Data contained in encrypted containers stored exclusively within Customer-controlled storage environments may not be accessible to or directly deletable by Locktera;

(b) Customer remains responsible for deleting Personal Data, encrypted containers, and associated copies maintained exclusively in Customer-controlled systems or storage environments;

(c) Personal Data contained in backup or archival systems controlled by Locktera may be deleted in accordance with documented backup retention and deletion procedures, provided that such data remains appropriately protected, is not restored to active Processing except where necessary for legitimate recovery purposes, and is deleted within the applicable retention cycle;

(d) Personal Data retained pursuant to applicable legal, regulatory, or binding governmental requirements may be retained solely to the extent and for the duration legally required; and

(e) deletion of cryptographic keys or revocation of authorization credentials may render encrypted data inaccessible but shall not automatically constitute deletion of Personal Data for purposes of applicable Data Protection Laws.

Where Personal Data cannot be immediately deleted from backup or archival systems for legitimate technical reasons, Locktera shall maintain appropriate safeguards and complete deletion in accordance with applicable retention procedures and legal requirements.

Locktera shall not be required to delete data residing exclusively in systems or infrastructure outside its possession or control.

Nothing in this Section permits Locktera to retain Personal Data beyond the period authorized under applicable Data Protection Laws.

9.4 Cryptographic Container Architecture and Customer Control

Customer acknowledges that Locktera's Services utilize cryptographic container architecture designed to provide persistent protection of Customer Data through encryption, authorization controls, and related security mechanisms.

Depending on the Services purchased and the applicable deployment configuration, Customer may control encrypted containers, storage environments, cryptographic keys, access policies, and retention settings.

Customer shall be responsible for managing the retention, deletion, and disposition of encrypted containers and associated Personal Data maintained exclusively in Customer-controlled storage environments.

Locktera shall remain responsible for deleting or returning Personal Data within Locktera's possession or control in accordance with this DPA and applicable Data Protection Laws.

Customer acknowledges that the immutable characteristics of Locktera's cryptographic containers are designed to prevent unauthorized modification of protected content.

Such immutability does not necessarily prevent deletion of an entire container or the deletion of associated data from storage systems where Customer or Locktera possesses the necessary administrative authority.

Revocation of access permissions, expiration of authorization policies, or destruction of cryptographic keys may restrict or prevent access to encrypted content but shall not automatically be treated as equivalent to deletion of the underlying Personal Data.

The parties shall cooperate as reasonably necessary to fulfill applicable deletion or return obligations, taking into account the applicable cryptographic architecture and their respective technical capabilities and responsibilities.

9.5 Certification of Deletion

Upon Customer's reasonable written request, Locktera shall provide written confirmation that Personal Data subject to deletion under this DPA has been deleted from Locktera-managed systems in accordance with Locktera's applicable deletion procedures, subject to any legally permitted retention and backup limitations described in this Section.

Such confirmation may be provided by an authorized Locktera representative and shall identify any material categories of Personal Data that remain subject to legally permitted retention, where disclosure of such information is appropriate and legally permissible.

Locktera shall not be required to certify deletion of Personal Data stored exclusively in Customer-controlled systems, third-party environments not managed by Locktera, or other infrastructure outside Locktera's possession or control.

Locktera shall not be required to represent that Personal Data has been irreversibly destroyed where such representation cannot reasonably be verified.

Nothing in this Section limits any certification, documentation, or verification obligations imposed by applicable Data Protection Laws or Standard Contractual Clauses.

9.6 Continued Protection of Retained Data

Any Personal Data retained by Locktera following expiration or termination of the Agreement pursuant to applicable legal requirements or permitted backup and archival retention procedures shall remain subject to the confidentiality, security, and data protection obligations set forth in this DPA and applicable Data Protection Laws.

Such Personal Data shall be protected against unauthorized access, use, disclosure, alteration, or destruction through appropriate technical and organizational measures.

Locktera shall restrict Processing of retained Personal Data to purposes necessary to comply with applicable legal requirements, maintain permitted backup or archival records, or fulfill other legally authorized obligations.

Locktera shall not use retained Personal Data for independent commercial purposes inconsistent with this DPA.

Upon expiration of the applicable retention period, Locktera shall delete the retained Personal Data in accordance with its documented deletion procedures, unless continued retention is required by applicable law.

The obligations of this Section shall survive termination or expiration of the Agreement for as long as Locktera retains Personal Data subject to this DPA.

10. INTERNATIONAL DATA TRANSFERS

10.1 Authorization of International Transfers

Customer acknowledges and agrees that Locktera may Process Personal Data in the United States and other jurisdictions in which Locktera or its authorized Subprocessors operate, as necessary to provide, operate, secure, maintain, and support the Services, subject to the requirements of this DPA and applicable Data Protection Laws.

Customer authorizes Locktera to transfer Personal Data internationally for such purposes, provided that any Restricted Transfer is conducted in accordance with the applicable safeguards set forth in this Section.

Customer acknowledges that the location of Processing may vary depending on the Services purchased, Customer-selected deployment region, infrastructure configuration, and location of authorized Subprocessors.

Where Customer selects or controls a storage environment or geographic deployment region, Customer shall be responsible for the configuration and management of that environment to the extent under Customer's control.

Any expressly agreed data residency commitments shall be governed by the applicable Agreement or Order Form. Such commitments shall not be interpreted as restricting other Processing activities unless expressly specified.

Nothing in this Section authorizes Locktera to transfer Personal Data in violation of applicable Data Protection Laws or an express contractual data residency restriction.

10.2 Compliance with Data Protection Laws

Each party shall comply with its respective obligations under applicable Data Protection Laws concerning international transfers of Personal Data.

Locktera shall ensure that Restricted Transfers for which Locktera is responsible are conducted in accordance with applicable requirements, including Chapter V of the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and other applicable international data transfer laws.

Customer shall remain responsible for determining whether its intended use of the Services, selection of storage locations, and instructions concerning international transfers comply with Data Protection Laws applicable to Customer.

Where Locktera acts as a Processor, Locktera shall Process and transfer Personal Data only in accordance with Customer's documented instructions, including those reflected in the Agreement, this DPA, and Customer's authorized configuration of the Services, unless otherwise required by applicable law.

Where applicable Data Protection Laws require additional safeguards, assessments, or transfer documentation, the parties shall reasonably cooperate to implement the measures required for the relevant transfer.

Nothing in this Section limits either party's mandatory obligations under applicable Data Protection Laws or Standard Contractual Clauses.

10.3 Transfer Safeguards

Where a Restricted Transfer requires an appropriate legal transfer mechanism under applicable Data Protection Laws, the parties shall implement or rely upon a valid transfer mechanism applicable to the relevant transfer.

Such mechanisms may include, as applicable:

(a) the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914, as amended or replaced;

(b) the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement, or another legally recognized transfer mechanism under UK Data Protection Laws;

(c) applicable Swiss adaptations to the European Commission Standard Contractual Clauses or another transfer mechanism recognized under Swiss Data Protection Laws;

(d) an applicable adequacy decision or determination issued by the competent regulatory authority;

(e) an applicable certification-based transfer mechanism, where the relevant parties and transfer are covered by a valid certification and any required commitments; or

(f) another transfer mechanism expressly permitted under applicable Data Protection Laws.

Where the Standard Contractual Clauses are required for a Restricted Transfer between Customer and Locktera, they shall be incorporated into and form part of this DPA in accordance with Section 11 and Appendix I.

The applicable Standard Contractual Clauses module shall be determined by the parties' actual roles in the relevant transfer.

Where required by applicable Data Protection Laws, the parties shall conduct or reasonably cooperate in applicable transfer impact assessments and implement supplementary measures necessary to provide the required level of protection.

Customer acknowledges that encryption, cryptographic access controls, and Customer-controlled key management may constitute relevant technical safeguards but do not independently replace a legally required international transfer mechanism.

In the event of a conflict between this DPA and applicable Standard Contractual Clauses, the Standard Contractual Clauses shall prevail to the extent required by applicable law.

10.4 Subprocessor Transfers

Locktera may authorize Subprocessors to Process Personal Data in jurisdictions outside the jurisdiction in which Customer is established, subject to Sections 6 and 10 of this DPA and applicable Data Protection Laws.

Where a transfer of Personal Data to a Subprocessor constitutes a Restricted Transfer, Locktera shall ensure that an appropriate transfer mechanism is implemented in accordance with applicable Data Protection Laws.

Locktera shall ensure that Subprocessors are subject to written contractual obligations governing the protection and Processing of Personal Data as required by Section 6 of this DPA.

Where applicable, such obligations shall include appropriate international transfer safeguards, confidentiality protections, security measures, and restrictions on further Processing or disclosure.

Locktera shall remain responsible for its Subprocessors' performance of their applicable data protection obligations as provided in Section 6.3 and applicable Data Protection Laws.

Customer acknowledges that third-party infrastructure, storage, hosting, and other service providers independently selected and engaged by Customer are not Subprocessors of Locktera solely by virtue of their integration with or use in connection with the Services.

Nothing in this Section limits Locktera's obligations regarding Restricted Transfers or the engagement of Subprocessors under applicable Standard Contractual Clauses.

10.5 Government Access Requests

Locktera shall implement appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful access, including access by governmental authorities that is not permitted under applicable law.

Where Locktera receives a legally binding request from a governmental, regulatory, law enforcement, or judicial authority seeking disclosure of Personal Data Processed on behalf of Customer, Locktera shall:

(a) review the request to determine its legal validity and applicable scope;

(b) notify Customer of the request before disclosure, where legally permitted, unless an applicable legal exception permits or requires otherwise;

(d) challenge or seek clarification of requests where there are reasonable grounds to conclude that the request is unlawful or exceeds the requesting authority's legal powers, to the extent required by applicable law or Standard Contractual Clauses; and

(e) maintain appropriate records of governmental access requests and related disclosures to the extent required by applicable law.

Where Locktera is legally prohibited from notifying Customer, Locktera shall use reasonable efforts, where legally permissible and required by applicable law, to obtain permission to provide such notification.

Customer acknowledges that Locktera's ability to respond to governmental access requests may be limited by its cryptographic architecture and the extent to which Customer controls encryption keys, storage environments, and access permissions.

Locktera shall not be required to obtain or reconstruct cryptographic keys that it does not possess or control, except to the extent required by applicable law.

Nothing in this Section limits obligations imposed by applicable Standard Contractual Clauses, including requirements concerning notification, assessment, documentation, and challenges to governmental access requests.

10.6 Continued Protection of Personal Data

Personal Data transferred internationally in connection with the Services shall remain subject to the confidentiality, security, Processing limitations, and other applicable data protection obligations established under this DPA and applicable Data Protection Laws.

Locktera shall maintain appropriate technical and organizational measures for Personal Data Processed within Locktera-managed systems, regardless of the jurisdiction in which such Processing occurs.

Where Customer controls the storage environment, cryptographic keys, authorization configurations, or other security components, Customer shall remain responsible for the security and administration of those components in accordance with this DPA.

The parties shall cooperate, as reasonably necessary and required by applicable Data Protection Laws, to maintain appropriate protections for Personal Data subject to international transfers.

Where applicable law or a competent supervisory authority determines that a Restricted Transfer cannot lawfully continue under the available transfer mechanisms and safeguards, the parties shall cooperate in good faith to identify a lawful alternative.

If no lawful alternative is reasonably available, the affected Processing or transfer shall be suspended or terminated to the extent required by applicable law.

Nothing in this Section requires Locktera to continue Processing or transferring Personal Data in violation of applicable Data Protection Laws.

11. STANDARD CONTRACTUAL CLAUSES

Where the Processing of Personal Data under the Agreement involves a Restricted Transfer requiring appropriate safeguards under applicable Data Protection Laws, the parties agree that the applicable Standard Contractual Clauses shall be incorporated into and form part of this DPA.

For transfers subject to the GDPR, the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914, as amended or replaced, shall apply where required by applicable law.

The applicable module of the Standard Contractual Clauses shall be determined according to the parties' actual roles in the relevant transfer:

(a) Module Two (Controller to Processor) shall apply where Customer acts as a Controller and Locktera acts as a Processor receiving Personal Data on Customer's behalf.

(b) Module Three (Processor to Processor) shall apply where Customer acts as a Processor on behalf of another Controller and Locktera acts as a further Processor receiving Personal Data in connection with the Services.

For purposes of the applicable Standard Contractual Clauses, Customer shall act as the Data Exporter and Locktera shall act as the Data Importer, where those roles accurately reflect the relevant transfer.

The applicable Standard Contractual Clauses shall be completed through the elections and information set forth in Appendix I, including the identification of the parties, description of transfers, applicable technical and organizational security measures, and authorized Subprocessors.

Where the applicable transfer involves Personal Data subject to the UK GDPR, the parties shall implement the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement, or another legally recognized transfer mechanism, as applicable.

Where the applicable transfer involves Personal Data subject to Swiss Data Protection Laws, the parties shall apply the modifications or additional provisions necessary to satisfy applicable Swiss international transfer requirements.

The Standard Contractual Clauses shall apply only to transfers for which such clauses constitute an applicable and valid transfer mechanism under relevant Data Protection Laws.

Where a Restricted Transfer is lawfully conducted pursuant to an applicable adequacy decision or another valid transfer mechanism, the Standard Contractual Clauses shall not be required solely by reason of this DPA.

The parties shall comply with their respective obligations under the applicable Standard Contractual Clauses, including obligations relating to security, confidentiality, Subprocessors, Data Subject rights, governmental access requests, and international data transfers.

Nothing in this DPA or the Agreement shall modify, restrict, or exclude the mandatory rights and obligations established by the applicable Standard Contractual Clauses.

In the event of any conflict between the applicable Standard Contractual Clauses and this DPA or the Agreement, the Standard Contractual Clauses shall prevail to the extent of such conflict.

The parties acknowledge that the application of the Standard Contractual Clauses shall not expand their contractual obligations beyond those required by the applicable clauses and Data Protection Laws, except as otherwise expressly agreed in writing.

12. AUDIT RIGHTS

12.1 Compliance Documentation

Locktera shall make available to Customer, upon reasonable written request and subject to appropriate confidentiality and security protections, information reasonably necessary to demonstrate Locktera's compliance with its obligations under this DPA and applicable Data Protection Laws.

Such information may include, to the extent available and relevant:

(a) descriptions or summaries of Locktera's technical and organizational security measures;

(b) applicable security policies, procedures, and compliance documentation;

(d) responses to reasonable security and data protection questionnaires; and

(e) other information reasonably necessary to demonstrate compliance with applicable data protection obligations.

Locktera shall not be required to obtain or maintain any particular certification, audit report, or third-party assessment unless expressly agreed in writing or required by applicable law.

Information provided under this Section may be subject to reasonable confidentiality restrictions, including restrictions on disclosure to third parties, except where disclosure is required by applicable Data Protection Laws.

Locktera may provide summaries, redacted materials, or other appropriate documentation where necessary to protect confidential information, proprietary technology, or the security of the Services, provided that such measures do not prevent Customer from exercising mandatory rights under applicable Data Protection Laws or Standard Contractual Clauses.

12.2 Independent Third-Party Audits

Where available and reasonably sufficient to demonstrate compliance with applicable obligations, Locktera may provide independent third-party audit reports, security assessments, certifications, or equivalent compliance documentation to assist Customer in exercising its audit and inspection rights.

The parties acknowledge that independent third-party assessments may provide an efficient means of evaluating Locktera's security and data protection practices without requiring duplicative audits of the same systems and controls.

Customer shall reasonably consider such documentation before requesting an additional audit or inspection.

Where the documentation provided is insufficient to satisfy Customer's audit rights under applicable Data Protection Laws or Standard Contractual Clauses, Locktera shall permit and contribute to an audit or inspection to the extent required by those laws or clauses, subject to the reasonable confidentiality, security, scheduling, and operational safeguards set forth in this Section.

Nothing in this Section shall be interpreted as eliminating or restricting audit and inspection rights that cannot lawfully be excluded.

12.3 Restrictions on Direct Audits

Customer may request an audit or inspection reasonably necessary to verify Locktera's compliance with this DPA and applicable Data Protection Laws.

Except where a shorter period is required by applicable law or justified by a material Personal Data Breach or reasonable evidence of material noncompliance, Customer shall provide at least thirty (30) days' prior written notice of a requested audit.

Audits shall ordinarily be limited to once during any twelve (12) month period, unless additional audits are required by applicable Data Protection Laws, Standard Contractual Clauses, or circumstances reasonably indicating material noncompliance.

Any audit or inspection shall:

(a) be limited to matters reasonably necessary to verify Locktera's compliance with applicable data protection obligations;

(b) be conducted during normal business hours, where practicable;

(d) be subject to reasonable confidentiality and information security requirements;

(e) be performed by appropriately qualified personnel or an independent auditor bound by appropriate confidentiality obligations; and

(f) avoid unnecessary access to Personal Data, proprietary technology, and systems unrelated to the applicable Processing activities.

Locktera may reasonably object to a proposed independent auditor where the auditor presents a material conflict of interest, lacks appropriate qualifications, or is a direct competitor of Locktera, provided that Locktera cooperates in identifying a suitable alternative without unreasonably delaying an audit required by applicable law.

Customer shall not conduct penetration testing, vulnerability scanning, exploit testing, or other active security testing of Locktera systems or Services without Locktera's prior written authorization and an agreed testing scope, except to the extent a particular inspection or activity is legally required and cannot lawfully be restricted.

Where an audit identifies material noncompliance attributable to Locktera, Locktera shall take appropriate corrective measures consistent with its obligations under this DPA and applicable Data Protection Laws.

Nothing in this Section limits mandatory audit or inspection rights under applicable Data Protection Laws or Standard Contractual Clauses.

12.4 Protection of Confidential and Sensitive Information

All audits, inspections, and disclosures of compliance information shall be conducted subject to appropriate confidentiality, security, and information protection measures.

Locktera may restrict, redact, or provide alternative evidence concerning information where unrestricted disclosure would reasonably:

(a) compromise the security or integrity of Locktera's systems, infrastructure, or Services;

(b) expose Personal Data or confidential information belonging to other customers;

(c) disclose proprietary source code, cryptographic algorithms or implementation details, cryptographic key management systems, trade secrets, or other proprietary technology;

(d) expose security vulnerabilities, authentication credentials, encryption keys, or sensitive infrastructure configurations;

(e) violate applicable law, legal privilege, or enforceable confidentiality obligations; or

(f) materially increase the risk of unauthorized access, misuse, or compromise of the Services.

Where information is restricted or redacted, Locktera shall provide reasonable alternative documentation, explanations, independent verification, or other appropriate evidence sufficient to demonstrate compliance to the extent required by applicable Data Protection Laws.

Nothing in this Section permits Locktera to withhold information or prevent an audit or inspection where disclosure or access is mandatory under applicable Data Protection Laws or Standard Contractual Clauses.

Any information disclosed during an audit shall be used solely for legitimate compliance verification purposes, except as otherwise required by applicable law.

12.5 Audit Costs

Each party shall bear its own internal costs associated with routine compliance documentation and cooperation required under this DPA.

Customer shall bear the costs of its own personnel, representatives, and independent auditors engaged to conduct an audit or inspection.

Where Customer requests an audit or inspection requiring substantial additional engineering, administrative, technical, or operational resources beyond Locktera's standard compliance procedures, Locktera may charge reasonable and documented fees for such additional assistance, to the extent permitted by applicable Data Protection Laws.

Any applicable fees shall be communicated to Customer in advance where reasonably practicable.

Locktera shall not impose fees that effectively prevent Customer from exercising mandatory audit or inspection rights under applicable Data Protection Laws or Standard Contractual Clauses.

Where an audit identifies material noncompliance attributable to Locktera, Locktera shall be responsible for the reasonable costs of corrective measures necessary to remedy its noncompliance, subject to applicable law and the Agreement.

Nothing in this Section limits the rights of competent supervisory authorities or other persons exercising mandatory statutory audit or inspection powers.

12.6 No Direct Infrastructure Access

Except where expressly agreed in writing or required by applicable Data Protection Laws or Standard Contractual Clauses, Customer and its representatives shall not be entitled to unrestricted or unsupervised access to:

(a) Locktera production systems or infrastructure environments;

(b) proprietary source code, software repositories, or development environments;

(d) systems or environments containing Personal Data or confidential information belonging to other customers;

(e) internal network infrastructure, authentication systems, or administrative security controls; or

(f) other systems or information where access would create a material security, confidentiality, or operational risk.

Where a direct inspection is required under applicable Data Protection Laws or Standard Contractual Clauses, Locktera may implement reasonable safeguards, including supervised access, limited-scope inspection, secure review environments, confidentiality agreements, or independent third-party verification, provided that such safeguards do not prevent the effective exercise of mandatory inspection rights.

Locktera may satisfy routine compliance verification requests through appropriate documentation, security assessments, independent audit reports, or other reasonable evidence where such materials adequately demonstrate compliance.

Nothing in this Section shall be interpreted to eliminate or restrict mandatory audit or inspection rights under applicable Data Protection Laws or Standard Contractual Clauses.

13. CONFIDENTIALITY

13.1 Personnel Confidentiality Obligations

Locktera shall ensure that personnel authorized to Process Personal Data on behalf of Customer are subject to appropriate confidentiality obligations before being granted access to such Personal Data.

Such obligations may arise from written employment agreements, contractor agreements, confidentiality agreements, or applicable statutory or professional duties of confidentiality.

Locktera shall implement reasonable measures designed to ensure that authorized personnel:

(a) Process Personal Data only as necessary to perform their assigned responsibilities in connection with the Services;

(b) access Personal Data only in accordance with applicable authorization requirements and documented instructions;

(d) receive appropriate training or instructions concerning confidentiality, information security, and the handling of Personal Data relevant to their responsibilities; and

(e) are prohibited from using or disclosing Personal Data for unauthorized purposes.

Locktera shall remain responsible for ensuring that its personnel comply with applicable confidentiality obligations within the scope of their authorized activities.

Nothing in this Section requires Locktera to provide Customer with copies of individual employment agreements, contractor agreements, or personnel records, except to the extent required by applicable Data Protection Laws.

13.2 Access Restrictions

Locktera shall implement and maintain appropriate technical and organizational measures designed to restrict access to Personal Data to authorized personnel who have a legitimate business need to access such Personal Data in connection with providing, operating, securing, maintaining, or supporting the Services.

Access to Personal Data shall be governed by the principle of least privilege and, where applicable, role-based access controls, authentication mechanisms, and other appropriate authorization procedures.

Locktera shall take reasonable measures designed to ensure that:

(a) personnel access is limited to the information and systems reasonably necessary for assigned responsibilities;

(b) access privileges are granted, reviewed, modified, and revoked in accordance with applicable security procedures;

(d) access to sensitive administrative functions and security systems is restricted to appropriately authorized personnel; and

(e) personnel access to Personal Data is subject to applicable confidentiality and information security requirements.

Customer acknowledges that Locktera's cryptographic container architecture and Customer-defined authorization policies may limit Locktera personnel's ability to access or decrypt Customer Data.

Locktera shall not be required to obtain or maintain access to plaintext Customer Data where such access is not necessary for the provision of the Services.

Nothing in this Section limits Locktera's obligation to implement appropriate security measures for Personal Data within its possession or control or otherwise Processed on behalf of Customer.

13.3 Continuing Obligations

The confidentiality obligations applicable to Locktera personnel shall continue following termination of their employment, contractor engagement, or other professional relationship with Locktera, in accordance with the applicable confidentiality obligations and legal requirements.

The confidentiality obligations established under this DPA shall survive termination or expiration of the Agreement for as long as Locktera retains or Processes Personal Data subject to this DPA, and for any longer period required by applicable law or the Agreement.

Nothing in this Section shall prohibit disclosures of Personal Data or confidential information where:

(a) disclosure is authorized by Customer in accordance with the Agreement and applicable Data Protection Laws;

(b) disclosure is necessary to provide the Services in accordance with Customer's documented instructions;

(c) disclosure is required by applicable law, lawful judicial process, or a legally binding governmental or regulatory request; or

(d) disclosure is otherwise expressly permitted under this DPA or the Agreement.

Where Locktera is legally required to disclose Personal Data, Locktera shall, unless prohibited by applicable law, provide Customer with reasonable prior notice and limit the disclosure to the information legally required.

The confidentiality obligations under this Section are supplemental to, and shall not diminish, any confidentiality obligations established under the Agreement or a separately executed nondisclosure agreement between the parties.

In the event of a conflict, the provision imposing the greater protection for Personal Data shall apply, except where otherwise required by applicable law or mandatory contractual provisions.

14. CCPA / CPRA PROVISIONS

14.1 Service Provider and Contractor Status

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act and its implementing regulations (collectively, the "CCPA"), applies to the Processing of Personal Information under the Agreement, Customer acts as a Business or other entity authorized to disclose Personal Information to Locktera, and Locktera acts as a Service Provider or Contractor, as applicable, with respect to Personal Information Processed on

14.2 Restrictions on Use of Personal Data

Locktera shall not:

(a) sell Personal Information, as defined under the CCPA;

(b) share Personal Information for cross-context behavioral advertising, as defined under the CCPA;

(c) retain, use, or disclose Personal Information for any purpose other than the limited and specified business purposes established in the Agreement and this DPA, except as otherwise expressly permitted by the CCPA;

(d) retain, use, or disclose Personal Information outside the direct business relationship between Locktera and Customer, except as expressly permitted by the CCPA; or

(e) use Personal Information for independent commercial purposes inconsistent with its role as a Service Provider or Contractor under the CCPA.

Notwithstanding the foregoing, Locktera may Process Personal Information to the extent permitted by the CCPA for legitimate activities reasonably necessary to provide, maintain, secure, troubleshoot, or improve the quality and reliability of the Services, including:

(i) detecting, preventing, and investigating security incidents;

(ii) protecting against malicious, deceptive, fraudulent, or illegal activity;

(iii) authentication, authorization, and access control enforcement;

(iv) maintaining audit logs, security records, and operational records;

(v) debugging, troubleshooting, and correcting errors affecting the Services; and

(vi) performing other activities expressly permitted for Service Providers or Contractors under the CCPA.

Any such Processing shall remain subject to the applicable restrictions and requirements of the CCPA, including limitations on the use, disclosure, and combination of Personal Information.

Locktera shall not use Personal Information for cross-context behavioral advertising or for building or modifying consumer profiles for unrelated commercial purposes.

14.3 Restrictions on Combining Data

Locktera shall not combine Personal Information received from or on behalf of Customer with Personal Information received from other customers, collected through Locktera's own interactions with consumers, or obtained from third parties, except to the extent expressly permitted under the CCPA and its implementing regulations.

Permitted combinations may include Processing reasonably necessary to perform the business purposes specified in the Agreement and this DPA, including authorized security, fraud prevention, debugging, and service operations, provided that the combination is permitted by applicable law.

Locktera shall not combine Personal Information for cross-context behavioral advertising, unrelated consumer profiling, or other purposes prohibited for Service Providers or Contractors under the CCPA.

Nothing in this Section prohibits Locktera from using aggregated or deidentified information in accordance with the CCPA, provided that Locktera satisfies all applicable requirements governing such information, including restrictions on reidentification and any required safeguards.

14.4 Compliance with CCPA / CPRA

To the extent the CCPA applies to the Services, Locktera shall:

(a) comply with all applicable obligations imposed on Service Providers and Contractors under the CCPA;

(b) provide Personal Information Processed on behalf of Customer with the same level of privacy protection required of Customer under the CCPA, to the extent applicable to Locktera's Processing activities;

(c) notify Customer without undue delay if Locktera determines that it can no longer meet its applicable obligations under the CCPA;

(d) provide reasonable assistance to Customer in responding to verifiable consumer requests, taking into account the nature of the Processing and the information reasonably available to Locktera;

(e) cooperate with Customer regarding reasonable and appropriate steps required under the CCPA to address unauthorized use or disclosure of Personal Information;

(f) ensure that any third party engaged by Locktera to Process Personal Information on Customer's behalf is subject to contractual obligations required under the CCPA, where applicable; and

(g) make available information reasonably necessary for Customer to verify Locktera's compliance with the applicable requirements of this Section, subject to Section 12 of this DPA and mandatory requirements of the CCPA.

Customer remains responsible for determining the lawful purposes of Processing, providing required consumer notices, establishing applicable legal bases or authorizations, and responding to consumer requests except to the extent that applicable law imposes direct obligations on Locktera.

Locktera's assistance obligations shall be limited to reasonable measures appropriate to the nature of the Services and the Personal Information within Locktera's possession or control, without limiting any mandatory obligation imposed by the CCPA.

Nothing in this Section requires Locktera to decrypt Customer Data, obtain Customer-controlled encryption keys, or access Customer-managed storage environments where Locktera does not possess the necessary access or authority, except to the extent required by applicable law.

14.5 Customer Rights to Take Reasonable Steps

Customer shall have the right, upon reasonable notice, to take reasonable and appropriate steps to verify that Locktera Processes Personal Information in a manner consistent with Customer's obligations under the CCPA and the requirements of this DPA.

Such verification may include reasonable requests for compliance documentation, security information, written explanations, or other appropriate evidence concerning Locktera's Processing of Personal Information.

Customer shall also have the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use or disclosure of Personal Information by Locktera, including requesting corrective action reasonably necessary to restore compliance with the CCPA.

Locktera shall cooperate in good faith with such requests and shall take appropriate corrective measures where required by applicable law.

The parties shall coordinate verification and remediation activities in accordance with the reasonable confidentiality, security, and operational safeguards established in Section 12 of this DPA, provided that such safeguards do not prevent Customer from exercising rights required by the CCPA.

Customer shall not be entitled to unrestricted access to Locktera's proprietary source code, cryptographic systems, production infrastructure, or confidential information belonging to other customers solely by virtue of this Section, except to the extent access is required by applicable law.

Nothing in this Section limits Customer's mandatory rights under the CCPA or Locktera's obligations to cooperate with lawful regulatory inquiries.

15. LIMITATION OF LIABILITY

Except to the extent prohibited by applicable Data Protection Laws or mandatory provisions of the Standard Contractual Clauses, the limitations of liability, exclusions of damages, indemnification provisions, and other liability allocations established under the Agreement shall apply to all claims, losses, damages, liabilities, costs, and expenses arising out of or relating to this DPA.

For clarity:

(a) Application of Agreement Liability Limits. Any claims arising out of or relating to this DPA, including claims involving the Processing of Personal Data, Security Incidents, confidentiality, data protection obligations, or international data transfers, shall be subject to the applicable limitations of liability and exclusions of damages established under the Agreement, except to the extent such limitations or exclusions are prohibited by applicable law or conflict with mandatory provisions of the Standard Contractual Clauses.

(b) No Independent or Additional Liability. This DPA shall not establish a separate or additional limitation of liability, increase the aggregate liability cap applicable under the Agreement, or create additional indemnification obligations unless expressly agreed by the parties in writing. Claims arising under this DPA and the Agreement shall be aggregated for purposes of applying the relevant liability limitations, and neither party shall be entitled to duplicate recovery for the same loss.

(c) Mandatory Legal Obligations. Nothing in this DPA or the Agreement shall exclude or limit liability, remedies, regulatory powers, or Data Subject rights to the extent such exclusion or limitation is prohibited by applicable Data Protection Laws or mandatory provisions of the Standard Contractual Clauses. Any contractual limitation shall apply only to the extent legally permissible and shall not prejudice rights or remedies that cannot lawfully be restricted.

The parties acknowledge that each remains responsible for its respective obligations under applicable Data Protection Laws. Nothing in this Section shall be construed to make Locktera responsible for Customer's independent legal obligations, instructions, authorization decisions, or systems and configurations under Customer's control, except to the extent liability is attributable to Locktera under applicable law or the Agreement.

16. ORDER OF PRECEDENCE

In the event of any conflict or inconsistency among this DPA, the Agreement, any applicable Order Form, and any Standard Contractual Clauses or other legally required data transfer mechanisms, the following order of precedence shall apply:

(a) Standard Contractual Clauses and Mandatory Transfer Mechanisms. Where applicable, the Standard Contractual Clauses, including any applicable UK Addendum, International Data Transfer Agreement, or Swiss adaptations, shall prevail over conflicting provisions of this DPA or the Agreement to the extent necessary to preserve their validity, effectiveness, and compliance with applicable Data Protection Laws. Nothing in this DPA or the Agreement shall modify, contradict, or restrict rights or obligations established under mandatory provisions of such transfer mechanisms.

(b) Data Processing Addendum. Subject to paragraph (a), this DPA shall prevail over conflicting provisions of the Agreement or any Order Form solely with respect to the Processing of Personal Data and the parties' obligations under applicable Data Protection Laws.

(c) Agreement and Order Forms. Except as provided in paragraphs (a) and (b), the Agreement and applicable Order Forms shall govern all other matters, including commercial terms, fees, payment obligations, service descriptions, warranties, indemnification, limitations of liability, and other contractual obligations, in accordance with their applicable order-of-precedence provisions.

(d) Consistent Interpretation. The parties shall interpret this DPA and the Agreement, to the extent reasonably possible, in a manner that gives effect to all provisions without creating unnecessary conflicts

17. TERM

This DPA shall become effective upon the effective date of the Agreement or the date on which Locktera first Processes Personal Data on behalf of Customer under the Agreement, whichever occurs first.

This DPA shall remain in effect for the duration of the Agreement and, following its termination or expiration, for as long as Locktera continues to Process Personal Data on behalf of Customer, including any period reasonably necessary to complete the return, deletion, or lawful retention of Personal Data in accordance with Section 9 of this DPA.

Termination or expiration of the Agreement shall not relieve either party of obligations under this DPA that, by their nature or under applicable Data Protection Laws, are intended to survive termination, including obligations relating to:

(a) confidentiality and protection of Personal Data;

(b) security measures applicable to Personal Data retained or Processed following termination;

(d) compliance with applicable international data transfer requirements;

(e) cooperation with legally required regulatory inquiries or compliance obligations; and

(f) any other obligations expressly stated to survive termination under this DPA or applicable law.

Following termination or expiration of the Agreement, Locktera shall not be required to continue providing the Services, maintaining Customer access to the Services, or retaining Personal Data beyond the periods required under the Agreement, this DPA, or applicable law.

Customer acknowledges that Personal Data, encrypted containers, cryptographic keys, or other Customer Data maintained in Customer-controlled storage environments may remain outside Locktera's possession or control following termination. Customer remains responsible for managing, retaining, exporting, or deleting such information within Customer-controlled environments.

Locktera's obligations regarding the return or deletion of Personal Data shall apply only to Personal Data within Locktera's possession or control, subject to Section 9 of this DPA and applicable Data Protection Laws.

Nothing in this Section shall limit any mandatory obligation or right arising under applicable Data Protection Laws or the Standard Contractual Clauses.

18. GOVERNING LAW

Except where otherwise required by applicable Data Protection Laws or mandatory provisions of the Standard Contractual Clauses or other applicable international data transfer mechanisms, this DPA shall be governed by and construed in accordance with the laws of the State of Texas, United States, without regard to its conflict of law principles.

The parties agree that:

(a) General Governing Law. The governing law and dispute resolution provisions established under the Agreement shall apply to this DPA, except to the extent inconsistent with mandatory requirements of applicable Data Protection Laws or legally required international data transfer mechanisms.

(b) European Union Standard Contractual Clauses. Where the Standard Contractual Clauses adopted under European Commission Implementing Decision (EU) 2021/914 apply, the governing law and jurisdiction specified in the applicable SCCs and Appendix I shall govern matters arising under those clauses. Such provisions shall apply to the extent required by the SCCs and shall not otherwise modify the governing law applicable to the Agreement or this DPA.

(c) United Kingdom Data Transfers. Where the UK International Data Transfer Addendum or International Data Transfer Agreement applies, the governing law and jurisdiction requirements established under the applicable UK transfer mechanism shall govern matters arising under that mechanism.

(d) Swiss Data Transfers. Where Swiss data protection requirements apply, the governing law, jurisdiction, and other mandatory requirements applicable to the relevant international data transfer mechanism shall govern matters arising under that mechanism to the extent required by Swiss law.

(e) Mandatory Legal Requirements. Nothing in this Section shall restrict the rights of Data Subjects, the jurisdiction of competent supervisory authorities or courts, or the application of mandatory provisions of applicable Data Protection Laws or Standard Contractual Clauses.

In the event of any conflict between the governing law provisions of this DPA and the mandatory governing law or jurisdiction requirements of applicable Standard Contractual Clauses or other legally required international data transfer mechanisms, the mandatory requirements shall prevail.

Nothing in this Section shall alter the governing law applicable to the Agreement for matters unrelated to the Processing of Personal Data, except as otherwise expressly agreed by the parties.

19. ACCEPTANCE

This Data Processing Addendum ("DPA") is incorporated into and forms an integral part of the Agreement governing Customer's access to and use of the Services.

By executing an Order Form, accepting the Agreement electronically, or otherwise entering into a binding Agreement that incorporates this DPA, Customer agrees to be bound by the terms of this DPA to the extent applicable to the Processing of Personal Data in connection with the Services.

The parties acknowledge and agree that:

(a) Incorporation by Reference. This DPA may be incorporated into the Agreement by reference, including through an electronic agreement, Order Form, or other legally binding acceptance mechanism.

(b) Electronic Acceptance. Electronic signatures and other legally valid forms of electronic acceptance shall have the same force and effect as handwritten signatures to the extent permitted by applicable law.

(c) Separate Execution Not Required. A separate signature on this DPA shall not be required where the DPA has been validly incorporated into a binding Agreement between the parties, except where separate execution is required by applicable law or expressly agreed in writing.

(d) Application to Services. This DPA shall apply to all Services provided by Locktera under the Agreement to the extent Locktera Processes Personal Data on behalf of Customer in connection with such Services.

(e) Separate Written Agreements. Where Customer and Locktera enter into a separately negotiated written agreement governing the Services, this DPA shall apply unless the parties expressly agree in writing to a different data processing addendum or other legally valid data protection terms governing the applicable Processing activities.

(f) Conflicting Customer Documents. No terms contained in a Customer purchase order, procurement document, acknowledgment, or other administrative document shall modify or supersede this DPA unless expressly accepted in writing by an authorized representative of Locktera.

(g) Standard Contractual Clauses. Where applicable, the Standard Contractual Clauses and other legally required international data transfer mechanisms incorporated into this DPA shall become effective in accordance with their terms and applicable Data Protection Laws, without requiring separate execution except where legally required.

This DPA shall remain effective in accordance with Section 17 and shall be interpreted in accordance with the order-of-precedence provisions established in Section 16.

APPENDIX I

STANDARD CONTRACTUAL CLAUSES

(Controller to Processor — Module Two; Processor to Processor — Module Three)

This Appendix forms part of and is incorporated into the Locktera Data Processing Addendum ("DPA").

To the extent a Restricted Transfer requires the use of Standard Contractual Clauses under applicable Data Protection Laws, the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time ("EU SCCs"), are incorporated by reference into this DPA.

The applicable module shall be determined by the parties' respective roles in relation to the Personal Data transferred:

(a) Module Two — Controller to Processor: Where Customer acts as a Controller and Locktera acts as a Processor, Module Two shall apply.

(b) Module Three — Processor to Processor: Where Customer acts as a Processor on behalf of another Controller and Locktera acts as a Subprocessor, Module Three shall apply.

Where Customer acts in different capacities with respect to different Processing activities, the applicable module shall be determined separately for each relevant Restricted Transfer.

The EU SCCs shall apply only to Restricted Transfers for which they constitute an applicable and legally valid transfer mechanism. Transfers subject to an applicable adequacy decision or another valid transfer mechanism shall not require reliance on the EU SCCs solely by virtue of this Appendix.

For Restricted Transfers subject to the UK GDPR, the parties shall use the applicable UK International Data Transfer Addendum to the EU SCCs or a separately executed International Data Transfer Agreement, as appropriate.

For Restricted Transfers subject to Swiss data protection law, the EU SCCs shall apply with the modifications required under applicable Swiss law.

The EU SCCs, applicable UK transfer mechanisms, and Swiss adaptations shall be interpreted in accordance with their mandatory terms and applicable Data Protection Laws.

Nothing in this Appendix shall modify, contradict, or restrict the mandatory rights and obligations established under the applicable Standard Contractual Clauses or other legally required international data transfer mechanisms.

In the event of a conflict between the applicable Standard Contractual Clauses and this DPA or the Agreement, the Standard Contractual Clauses shall prevail to the extent required by their terms and applicable law.

SCC CLAUSE ELECTIONS

For purposes of the EU Standard Contractual Clauses, the following elections and specifications shall apply:

Applicable Modules

Module Two (Controller to Processor) shall apply where Customer acts as a Controller and Locktera acts as a Processor.

Module Three (Processor to Processor) shall apply where Customer acts as a Processor and Locktera acts as a Subprocessor.

Clause 7 — Docking Clause

The optional docking clause shall apply, permitting additional parties to accede to the EU SCCs in accordance with their terms and with the agreement of the existing parties.

Clause 9 — Use of Subprocessors

Option 2 (General Written Authorization) shall apply.

Customer grants Locktera general written authorization to engage Subprocessors in accordance with Section 6 of the DPA.

Locktera shall provide at least thirty (30) days' prior notice of intended additions or replacements of Subprocessors, subject to any legally permissible emergency arrangements expressly established in Section 6.

Customer may object to an intended addition or replacement of a Subprocessor within the thirty (30) day notice period in accordance with Section 6 of the DPA.

Nothing in Section 6 shall diminish the requirements of Clause 9 of the applicable EU SCCs.

Clause 11 — Redress

The optional language concerning an independent dispute resolution body shall not apply.

Clause 17 — Governing Law

The EU SCCs shall be governed by the laws of Ireland.

Clause 18 — Choice of Forum and Jurisdiction

The courts of Ireland shall have jurisdiction over disputes arising under the EU SCCs, without prejudice to the rights of Data Subjects under Clause 18.

Annex I — Parties and Transfer Details

Annex I of this Appendix shall identify the Data Exporter, Data Importer, applicable roles, categories of Personal Data, Processing activities, transfer purposes, and competent supervisory authority.

Annex II — Technical and Organizational Measures

Annex II of this Appendix shall describe the technical and organizational security measures implemented by Locktera, taking into account the nature of the Services and the applicable Processing activities.

Annex III — Subprocessors

Annex III of this Appendix shall identify authorized Subprocessors and relevant Processing activities, as applicable to the selected module and Clause 9 authorization arrangements.

UK Restricted Transfers

Where the UK International Data Transfer Addendum is used, the parties shall complete or incorporate the information and elections required by the then-applicable mandatory UK Addendum, including its tables, selected EU SCC modules, and applicable termination provisions.

The UK Addendum shall modify the EU SCCs only as necessary for compliance with the UK GDPR and applicable UK transfer requirements.

Swiss Restricted Transfers

Where the EU SCCs are used for Restricted Transfers subject to Swiss data protection law:

(a) references to the GDPR shall be interpreted to include the Swiss Federal Act on Data Protection, where applicable;

(b) references to EU Member States and competent supervisory authorities shall be adapted as required under Swiss law;

(c) the Swiss Federal Data Protection and Information Commissioner shall act as the competent supervisory authority where required by applicable Swiss law;

(d) Data Subjects in Switzerland shall retain any mandatory rights of action and remedies required under Swiss law; and

(e) the EU SCCs shall otherwise apply subject to the modifications required for their lawful use under Swiss data protection law.

No Modification of Mandatory SCC Terms

The elections in this Appendix are intended to complete and supplement the EU SCCs without modifying their mandatory provisions.

Where any election or supplementary term conflicts with the applicable SCCs, the mandatory SCC provision shall control.

ANNEX I — DETAILS OF PROCESSING

A. LIST OF PARTIES

Data Exporter

Name: Customer, as identified in the applicable Agreement or Order Form.

Address: Customer's address as provided in the Agreement, Order Form, or applicable account registration records.

Contact Person: Customer's designated legal, privacy, or account contact, using the contact information maintained under the Agreement.

Activities Relevant to the Data Transferred: Customer's use of the Locktera Services for encryption, cryptographic container management, secure storage, transmission, access authorization, audit logging, and related Processing of Personal Data.

Role:

Controller, where Module Two applies.

Processor, where Module Three applies.

Signature and Date: As established by the parties' legally valid execution or acceptance of the Agreement incorporating this DPA and the applicable Standard Contractual Clauses.

Data Importer

Name: Locktera, Inc.

Address: Dallas, Texas, United States. The complete legal business address shall be provided in the final executed or published version.

Contact Person: Legal Department

Email: legal@locktera.com

Website: https://locktera.com

Activities Relevant to the Data Transferred: Provision of encryption services, cryptographic container management, authorization and access control services, audit logging, secure storage, infrastructure security, and related technical support and operational services.

Role: Processor under Module Two or Subprocessor under Module Three.

Signature and Date: As established by the parties' legally valid execution or acceptance of the Agreement incorporating this DPA and the applicable Standard Contractual Clauses.

B. DESCRIPTION OF TRANSFER

Categories of Data Subjects

Personal Data transferred may concern the following categories of Data Subjects, as determined by Customer's use of the Services:

(a) Customer employees, officers, and contractors;

(b) Customer end users and authorized application users;

(d) employees, contractors, customers, or other individuals associated with third parties on whose behalf Customer Processes Personal Data; and

(e) other individuals whose Personal Data Customer or its authorized users submit to or Process through the Services.

The specific categories of Data Subjects depend on Customer's Processing activities and the Personal Data submitted to the Services.

Categories of Personal Data

Personal Data transferred or otherwise Processed through the Services may include:

(a) names, email addresses, contact details, and account identifiers;

(b) usernames, authentication identifiers, user and organization identifiers, and related account information;

(d) metadata associated with encrypted containers, files, storage objects, and access policies;

(e) authorization records, access permissions, recipient information, and authentication events;

(f) audit logs, access history, security events, and service activity records;

(g) technical identifiers, including IP addresses, device information, and location-related information where applicable; and

(h) other categories of Personal Data submitted by Customer in accordance with the Agreement.

Customer determines the categories and content of Personal Data submitted to the Services. Locktera does not independently select or classify the contents of Customer files.

Personal Data may be Processed in encrypted form. Depending on the Services and deployment configuration, Locktera may also Process operational metadata, authorization information, audit records, and other service information necessary to provide and secure the Services.

Encryption of Customer content does not necessarily mean that all associated metadata is encrypted or inaccessible to Locktera.

Special Categories of Personal Data and Sensitive Information

The Services may be used to Process special categories of Personal Data under Article 9 of the GDPR, Personal Data relating to criminal convictions and offenses under Article 10, or other sensitive information where submitted by Customer and permitted under the Agreement.

Customer is responsible for determining whether such information may lawfully be submitted and Processed, including establishing applicable legal bases, conditions, authorizations, and safeguards.

Locktera shall Process such information only in accordance with the Agreement, this DPA, applicable documented instructions, and Data Protection Laws.

Applicable safeguards include the technical and organizational measures described in Annex II, taking into account the nature of the Services and the Processing activities.

Where required, the parties shall document additional safeguards appropriate to the particular sensitive data and associated risks.

Frequency of Transfer

Transfers may occur on a continuous, recurring, or occasional basis, depending on Customer's use and configuration of the Services.

Nature of Processing

Processing activities may include:

(a) encryption and cryptographic container creation;

(b) secure storage, retrieval, and transmission of encrypted Customer Data;

(d) authentication, identity verification, and access management;

(e) generation, retention, and analysis of audit logs and security records;

(f) maintenance of container metadata and service configuration information;

(g) infrastructure operation, maintenance, troubleshooting, and technical support;

(h) security monitoring, incident detection, and response; and

(i) other Processing activities necessary to provide the Services in accordance with Customer's documented instructions.

The specific Processing activities depend on the Services purchased and Customer's deployment configuration.

Purpose of Processing and Further Processing

Personal Data is Processed for the limited purposes of:

(a) providing the Services under the Agreement;

(b) protecting Customer Data through encryption, authorization controls, and related security mechanisms;

(d) maintaining appropriate access records, audit logs, and security information;

(e) detecting, investigating, and responding to security incidents; and

(f) complying with applicable legal obligations.

Locktera shall not sell Personal Data or share Personal Data for cross-context behavioral advertising.

Further Processing shall be limited to Customer's documented instructions and activities otherwise permitted or required under applicable Data Protection Laws.

Duration of Processing and Retention

Personal Data shall be Processed for the duration of the Agreement and for any additional period necessary to complete the return, deletion, or lawful retention of Personal Data in accordance with Section 9 of the DPA.

Upon termination or expiration of the Agreement, Locktera shall return or delete Personal Data within its possession or control in accordance with Customer's applicable instructions, Section 9 of the DPA, and the mandatory requirements of the applicable Standard Contractual Clauses.

Personal Data retained in backup systems or pursuant to applicable legal obligations shall remain subject to appropriate confidentiality and security protections until deletion.

Customer remains responsible for managing and deleting Personal Data maintained exclusively within Customer-controlled storage environments.

Transfers to Subprocessors

Where Locktera engages authorized Subprocessors, the subject matter, nature, and duration of their Processing shall be limited to the services performed on Locktera's behalf and governed by Section 6 of the DPA, the applicable Standard Contractual Clauses, and the relevant Subprocessor agreements.

The categories of Subprocessors and their applicable Processing activities shall be identified in Annex III or the authorized Subprocessor documentation referenced therein.

C. COMPETENT SUPERVISORY AUTHORITY

For purposes of Clause 13 of the European Union Standard Contractual Clauses, the competent supervisory authority shall be determined in accordance with the following provisions:

(a) Data Exporter Established in the European Economic Area. Where Customer, acting as Data Exporter, is established in an EU Member State, the competent supervisory authority shall be the supervisory authority responsible for ensuring Customer's compliance with the GDPR in relation to the applicable transfer.

(b) Data Exporter Not Established in the European Economic Area but Subject to the GDPR. Where Customer is not established in an EU Member State but is subject to the GDPR pursuant to Article 3(2), the competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses, including the rules applicable to Customer's designated representative under Article 27 of the GDPR or, where no such representative is required, the Member State in which relevant Data Subjects are located.

(c) United Kingdom Transfers. Where the UK International Data Transfer Addendum or International Data Transfer Agreement applies, the United Kingdom Information Commissioner's Office shall act as the competent supervisory authority to the extent provided under the applicable UK transfer mechanism.

(d) Swiss Transfers. Where the transfer is subject to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner shall act as the competent supervisory authority to the extent required under applicable Swiss law and the relevant transfer mechanism.

(e) Mandatory Requirements. Nothing in this Annex shall modify, restrict, or override the jurisdiction or authority of any supervisory authority established under applicable Data Protection Laws or mandatory provisions of the Standard Contractual Clauses.

The identity of the competent supervisory authority for each applicable Restricted Transfer shall be determined based on the circumstances of the Data Exporter and the requirements of the applicable transfer mechanism.

ANNEX II — TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Locktera implements and maintains technical and organizational security measures designed to protect Personal Data Processed on behalf of Customer against unauthorized or unlawful access, disclosure, alteration, loss, or destruction.

These measures are intended to provide a level of security appropriate to the nature, scope, context, and purposes of the Processing and the risks presented to Data Subjects, consistent with Article 32 of the GDPR and the applicable Standard Contractual Clauses.

The specific measures applicable to Customer depend on the Services purchased, deployment architecture, Customer configuration, and the respective responsibilities of Locktera, Customer, and applicable infrastructure providers.

1. Encryption and Cryptographic Protection

Locktera's Services incorporate data-centric security mechanisms designed to protect Customer Data independently of the storage environment in which protected files reside.

Applicable measures include:

(a) Encryption of Customer Data using AES-256-GCM cryptographic mechanisms;

(b) Protection of data transmitted over supported network connections using TLS 1.3 or other appropriately secure transport protocols;

(c) Cryptographic container technology designed to maintain encryption and associated security controls throughout the protected data lifecycle;

(d) Integrity verification mechanisms designed to detect unauthorized modification of protected data;

(e) Cryptographic authorization mechanisms designed to restrict access to protected content based on applicable access policies; and

(f) Cryptographic key protection and management mechanisms appropriate to the applicable Service and deployment configuration.

Where supported by the applicable Service, additional cryptographic integrity and authentication mechanisms may include post-quantum digital signature technologies.

The availability and configuration of particular cryptographic features may vary by Service and deployment architecture.

2. Cryptographic Key Management

Locktera employs cryptographic key management mechanisms designed to protect encryption keys and restrict their use to authorized operations.

Applicable measures include:

(a) Generation and handling of cryptographic keys using appropriate cryptographic mechanisms;

(b) Protection of encryption keys against unauthorized disclosure or use;

(d) Authorization checks governing access to cryptographic key material or decryption capabilities;

(e) Restrictions on administrative access to key management functions; and

(f) Procedures for key lifecycle management appropriate to the applicable Service.

Where Customer controls encryption keys, key storage, or associated credentials, Customer remains responsible for securing and managing those components.

Locktera shall not be responsible for the compromise of Customer-controlled cryptographic keys or credentials resulting from Customer's failure to implement appropriate security measures, except to the extent caused by Locktera's breach of its obligations under the Agreement or this DPA.

3. Access Control and Authentication

Locktera implements access control measures designed to restrict access to Personal Data and associated systems to authorized persons and processes.

Applicable measures include:

(a) Authentication mechanisms for users and administrative personnel;

(b) Role-based access controls and authorization mechanisms;

(d) Controls governing access to administrative functions and sensitive service components;

(e) Credential and session management safeguards;

(f) Periodic review of access privileges, as appropriate; and

(g) Logging of relevant authentication and authorization activities.

Customer remains responsible for configuring and managing Customer-defined authorization policies, user permissions, recipient access, and credentials within Customer-controlled systems and accounts.

4. Cryptographic Authorization and Persistent Data Protection

Locktera's cryptographic container architecture is designed to support persistent protection of Customer Data through encryption and policy-based authorization.

Depending on the applicable Service and configuration, security measures may include:

(a) Authorization validation before permitting access to protected content;

(b) Enforcement of Customer-configured access policies;

(d) Revocation or modification of access permissions where supported by the applicable Service;

(e) Generation of audit records relating to access requests and authorization decisions; and

(f) Integrity protections designed to detect unauthorized modification of protected containers.

Customer determines the applicable authorization policies and is responsible for ensuring that permissions are appropriately configured and maintained.

Locktera does not independently determine which individuals or entities should be authorized to access Customer Data.

5. Infrastructure and Network Security

Locktera maintains infrastructure and network security measures appropriate to the Services and deployment architecture.

Such measures may include:

(a) Use of cloud infrastructure providers with established security programs;

(b) Network access restrictions and segmentation, where applicable;

(d) Restrictions on administrative access to production infrastructure;

(e) Infrastructure configuration and security management procedures;

(f) Security monitoring and mechanisms designed to identify unauthorized access attempts; and

(g) Physical and environmental security controls provided by applicable infrastructure providers.

Where Services operate within Customer-controlled infrastructure, Customer remains responsible for the security and configuration of that infrastructure except to the extent expressly assumed by Locktera under the Agreement.

6. Monitoring, Logging, and Auditability

Locktera implements logging and monitoring mechanisms designed to support security operations, accountability, and investigation of relevant events.

Depending on the applicable Service, these measures may include:

(a) Recording of authentication and authorization events;

(b) Logging of access requests and access control decisions;

(d) Monitoring of relevant infrastructure and security events;

(e) Detection and investigation of suspicious or unauthorized activity; and

(f) Retention and protection of security records in accordance with applicable retention policies.

Audit records may contain Personal Data, including account identifiers, technical identifiers, IP addresses, and access-related metadata.

The availability, detail, and retention period of audit records may vary according to the Service, Customer configuration, and applicable retention requirements.

7. Organizational Security and Personnel Controls

Locktera maintains organizational security measures designed to reduce the risk of unauthorized access to Personal Data.

Applicable measures include:

(a) Confidentiality obligations for personnel authorized to access Personal Data;

(b) Access restrictions based on job responsibilities and legitimate business needs;

(d) Internal security policies and procedures;

(e) Administrative controls governing access to production systems;

(f) Review and adjustment of access rights when personnel responsibilities change or access is no longer required; and

(g) Personnel screening where appropriate, lawful, and applicable.

Access to Personal Data shall be limited to personnel who require such access for authorized business purposes.

8. Availability, Backup, and Recovery

Locktera maintains measures designed to support the availability and resilience of systems within its operational responsibility.

Depending on the applicable Service and deployment configuration, these measures may include:

(a) Infrastructure redundancy;

(b) Backup and recovery procedures;

(d) Monitoring of relevant infrastructure availability;

(e) Procedures for responding to service interruptions; and

(f) Business continuity and disaster recovery planning appropriate to the Services.

Where Customer elects to use Customer-controlled storage or infrastructure, Customer remains responsible for backup, recovery, availability, and resilience of those environments except as otherwise expressly agreed.

Service availability commitments, recovery objectives, and remedies shall be governed by the applicable Agreement and Service Level Agreement, where provided.

9. Security Incident Detection and Response

Locktera maintains procedures designed to identify, investigate, respond to, and remediate Security Incidents affecting Personal Data within its responsibility.

Applicable measures include:

(a) Procedures for receiving and evaluating reports of suspected security incidents;

(b) Investigation and assessment of relevant security events;

(d) Measures designed to contain and remediate identified security incidents;

(e) Documentation of material incidents and relevant response activities;

(f) Cooperation with Customer as required under the DPA; and

(g) Notification of Personal Data Breaches in accordance with Section 7 of the DPA and applicable Data Protection Laws.

Incident response obligations shall be interpreted consistently with the definition of a Personal Data Breach and the mandatory requirements of applicable Data Protection Laws and Standard Contractual Clauses.

10. Vulnerability Management and Security Evaluation

Locktera maintains processes designed to identify, evaluate, and address security vulnerabilities affecting systems within its responsibility.

Such processes may include:

(a) Security risk assessments;

(b) Vulnerability identification and evaluation;

(d) Review of relevant infrastructure and application security configurations;

(e) Evaluation of security controls following material system changes; and

(f) Periodic assessment of the effectiveness of technical and organizational security measures.

The frequency and scope of testing and evaluation shall be determined based on the nature of the Services, identified risks, and applicable legal requirements.

11. Data Minimization, Separation, and Retention

Locktera implements measures designed to limit Processing of Personal Data to activities necessary to provide, secure, maintain, and support the Services or otherwise comply with applicable law.

Applicable measures include:

(a) Limiting access to Personal Data to authorized purposes;

(b) Logical or cryptographic separation of Customer Data where applicable;

(c) Processing encrypted Customer content without routine access to plaintext where supported by the applicable architecture;

(d) Restricting use of Personal Data for unauthorized secondary purposes;

(e) Retention and deletion procedures consistent with Section 9 of the DPA; and

(f) Pseudonymization or other data protection techniques where appropriate and technically feasible.

Customer remains responsible for determining the categories, volume, sensitivity, and retention requirements of Personal Data submitted to the Services, subject to applicable law.

12. Subprocessor Security

Locktera requires Subprocessors that Process Personal Data on its behalf to be subject to written contractual obligations providing appropriate data protection and security safeguards.

Such obligations shall be consistent with Section 6 of the DPA, applicable Data Protection Laws, and the Standard Contractual Clauses where applicable.

Locktera shall implement appropriate measures for selecting and overseeing Subprocessors in accordance with its obligations under the DPA.

13. Government Access Requests

Locktera maintains procedures designed to address legally binding requests for access to Personal Data by governmental authorities.

Where applicable and legally permitted, Locktera shall:

(a) Review requests for legal validity;

(b) Limit disclosures to information legally required;

(d) Challenge requests that Locktera reasonably determines to be unlawful or disproportionate, where legally permissible; and

(e) Comply with the applicable requirements of the Standard Contractual Clauses governing governmental access requests.

14. Customer-Controlled Environments and Shared Responsibilities

Customer acknowledges that certain Locktera Services may operate with Customer-controlled storage, infrastructure, credentials, encryption keys, access policies, or other components.

Customer is responsible for securing and managing components within its possession or control, including:

(a) Customer-controlled cloud storage and infrastructure;

(b) Customer-managed cryptographic keys and credentials;

(d) Customer systems and applications integrated with the Services;

(e) Customer user administration and identity management; and

(f) Customer-controlled backup, retention, and deletion procedures.

Locktera remains responsible for the technical and organizational measures applicable to systems and Processing activities within its responsibility.

Nothing in this Section shall relieve Locktera of obligations imposed by applicable Data Protection Laws or the Standard Contractual Clauses.

15. Security Measures Review and Updates

Locktera may modify or update its technical and organizational security measures from time to time to reflect changes in technology, security risks, applicable legal requirements, and the Services.

Such modifications shall not materially diminish the overall level of security provided for Personal Data Processed under the Agreement.

Locktera shall maintain security measures appropriate to the risks of the Processing and shall provide information reasonably necessary to demonstrate compliance in accordance with Section 12 of the DPA.

The measures described in this Annex shall be interpreted consistently with the mandatory requirements of Article 32 of the GDPR and Annex II of the applicable Standard Contractual Clauses.

ANNEX III — LIST OF SUBPROCESSORS

1. Authorization to Engage Subprocessors

Customer authorizes Locktera to engage Subprocessors to Process Personal Data on Customer's behalf in accordance with Section 6 of the Data Processing Addendum ("DPA") and the applicable Standard Contractual Clauses ("SCCs").

Such authorization is subject to Locktera's compliance with the notification, objection, contractual protection, and oversight requirements established under the DPA and applicable Data Protection Laws.

2. Authorized Subprocessors

Locktera maintains a current list of authorized Subprocessors at:

https://locktera.com/legal/subprocessors

The Subprocessor list shall identify, as applicable:

(a) The legal name of each Subprocessor;

(b) The services or Processing activities performed;

(d) The country or countries in which Personal Data is Processed; and

(e) The applicable international data transfer safeguards, where required.

The Subprocessors identified in the current list are authorized to Process Personal Data to the extent necessary to perform their designated services, subject to the terms of the DPA.

The list shall be maintained with sufficient specificity to enable Customer to understand the Processing activities performed by each Subprocessor.

3. Categories of Subprocessors

Depending on the Services purchased and deployment configuration, Locktera may engage Subprocessors providing:

(a) Cloud hosting, computing, and infrastructure services;

(b) Data storage and database infrastructure services;

(d) Authentication and identity management services;

(e) Security monitoring, logging, and operational support services;

(f) Technical support and customer service infrastructure; and

(g) Other services reasonably necessary to provide, secure, maintain, or support the Services.

The categories above describe potential Subprocessor functions and do not, by themselves, authorize an unidentified entity to Process Personal Data where identification is required under applicable law or the SCCs.

4. Changes to Subprocessors

Locktera may add or replace Subprocessors in accordance with Section 6 of the DPA.

Locktera shall provide Customer with at least thirty (30) days' prior notice of an intended addition or replacement of a Subprocessor, except as otherwise permitted by Section 6 and applicable Data Protection Laws.

Notice may be provided through the notification mechanism established under Section 6, including electronic notification to Customer's designated contact where applicable.

Customer may object to an intended addition or replacement of a Subprocessor within the applicable notice period on reasonable grounds relating to data protection.

Objections shall be addressed in accordance with Section 6 of the DPA and the mandatory requirements of the applicable SCCs.

5. Contractual Obligations of Subprocessors

Locktera shall enter into written agreements with Subprocessors that impose data protection obligations appropriate to the Processing activities performed.

Such agreements shall include, as applicable:

(a) Processing of Personal Data only on documented instructions;

(b) Confidentiality obligations;

(d) Restrictions on unauthorized use or disclosure of Personal Data;

(e) Assistance with Personal Data Breach notification and other applicable data protection obligations;

(f) Requirements concerning return or deletion of Personal Data;

(g) Cooperation and compliance documentation obligations; and

(h) Applicable international data transfer safeguards.

Where required under Article 28 of the GDPR or the applicable SCCs, the Subprocessor shall be subject to data protection obligations providing an equivalent level of protection to those imposed on Locktera.

6. International Transfers by Subprocessors

Where a Subprocessor Processes Personal Data in a jurisdiction requiring an international data transfer mechanism, Locktera shall ensure that an appropriate lawful transfer mechanism is implemented.

Such mechanisms may include applicable Standard Contractual Clauses, an adequacy decision, or another legally recognized transfer mechanism.

Where required, Locktera shall implement supplementary safeguards appropriate to the circumstances of the transfer and applicable Data Protection Laws.

7. Responsibility for Subprocessors

Locktera shall remain responsible to Customer for the performance of its Subprocessors' data protection obligations to the extent required by applicable Data Protection Laws and the Standard Contractual Clauses.

Nothing in this Annex shall limit or exclude liability that cannot lawfully be limited or excluded under applicable Data Protection Laws or the Standard Contractual Clauses.

8. Customer-Controlled Third Parties

Third-party providers independently selected, contracted, and controlled by Customer, including providers of Customer-controlled storage, infrastructure, or applications, shall not be deemed Locktera Subprocessors solely because the Services integrate with those providers.

Where Locktera independently engages a third party to Process Personal Data on its behalf, that third party shall be treated as a Subprocessor to the extent required by applicable Data Protection Laws.

The classification of a third party shall be determined by the actual Processing relationship and responsibilities, rather than solely by the technical deployment model.

9. Standard Contractual Clauses

Where Module Two of the EU SCCs applies, the general written authorization and Subprocessor requirements of Clause 9 shall apply.

Where Module Three applies, the corresponding requirements of Clause 9 and the relevant obligations applicable to Processor-to-Processor transfers shall apply.

The parties shall identify authorized Subprocessors in this Annex or in an incorporated Subprocessor register with sufficient specificity to satisfy the requirements of the applicable SCCs.

In the event of any conflict between this Annex and the mandatory requirements of the applicable SCCs, the SCCs shall prevail.

APPENDIX ACCEPTANCE

This Appendix, including the applicable Standard Contractual Clauses, SCC Clause Elections, and Annexes I, II, and III, forms an integral part of the Locktera Data Processing Addendum ("DPA") and is incorporated into the Agreement governing Customer's use of the Services.

By executing or otherwise legally accepting an Agreement that incorporates the DPA, the parties agree to be bound by this Appendix to the extent applicable to their respective Processing activities and international transfers of Personal Data.

The parties acknowledge and agree that:

(a) Incorporation of Standard Contractual Clauses. Where required by applicable Data Protection Laws, the relevant Standard Contractual Clauses shall be incorporated into and form part of the contractual relationship between the parties.

(b) Applicable Modules. The applicable Standard Contractual Clauses module shall be determined by the parties' respective roles in relation to the relevant Processing activities, as specified in Appendix I.

(c) Electronic Acceptance. This Appendix may be accepted through electronic signature or another legally valid electronic contracting mechanism that establishes the parties' agreement to its terms.

(d) Separate Execution. Separate execution of this Appendix shall not be required where the applicable Standard Contractual Clauses and related annexes have been validly incorporated into a binding Agreement, except where separate execution is required by applicable law or the applicable transfer mechanism.

(e) Mandatory Legal Requirements. Nothing in this Appendix shall modify, restrict, or supersede any mandatory provision of the applicable Standard Contractual Clauses or other legally required international data transfer mechanism.

(f) Order of Precedence. In the event of any conflict between this Appendix, the DPA, and the Agreement, the order-of-precedence provisions established in Section 16 of the DPA shall apply, subject to the mandatory precedence requirements of the applicable Standard Contractual Clauses.

This Appendix shall become effective upon the parties' legally valid acceptance of the Agreement incorporating the DPA and shall remain effective for as long as required under the applicable Standard Contractual Clauses and Data Protection Laws.

CORE PRODUCTS

INTEGRATIONS

PLATFORM HIGHLIGHTS

Zero-Trust Architecture

Press Releases

Articles

White Papers

Knowledge Base

Case Studies

Contact Us

CORE PRODUCTS

INTEGRATIONS

PLATFORM HIGHLIGHTS

Zero-Trust Architecture

Press Releases

Articles

White Papers

Knowledge Base

Case Studies

Contact Us

1. DEFINITIONS

1.1 Personal Data

1.2 Data Protection Laws

1.3 Controller

1.4 Processor

1.5 Subprocessor

1.6 Processing

1.7 Data Subject

1.8 Security Incident

1.9 Restricted Transfer

1.10 Standard Contractual Clauses (SCCs)

2. ROLES OF THE PARTIES

2.1 Controller and Processor Relationship

2.2 Customer Processing Instructions

2.3 Locktera Processing Limitations

2.4 Customer Responsibilities as Controller

3. PROCESSING OF PERSONAL DATA

3.1 Processing Scope and Instructions

3.2 Processing Limitations

3.3 Limited Access to Personal Data

3.4 Cryptographic Enforcement and Customer Control

3.5 Compliance with Customer Instructions

3.6 GDPR Article 28 Compliance

3.7 Nature, Purpose, and Duration of Processing

4. CUSTOMER OBLIGATIONS

4.1 Customer Responsibility as Controller

4.2 Access Control and Authorization Responsibilities

4.3 Security Responsibilities of Customer

4.4 Compliance with Data Protection Laws

4.5 Customer Instructions

5. SECURITY MEASURES

5.1 Implementation of Security Measures

5.2 Technical Safeguards

5.3 Organizational Safeguards

5.4 Cryptographic Enforcement Architecture

5.5 Customer Security Responsibilities

5.6 Security Measure Evolution

5.7 Customer-Controlled Cryptographic Protection

6. SUBPROCESSORS

6.1 General Authorization

6.2 Subprocessor Obligations

6.3 Locktera Responsibility

6.4 Subprocessor List and Updates

6.5 Customer Objection Rights

6.6 Cross-Border Transfers by Subprocessors

7. SECURITY INCIDENT NOTIFICATION

7.1 Notification Obligation

7.2 Incident Notification Content

7.3 Incident Response and Mitigation

7.4 Confidentiality and Security of Incident Information

7.5 Customer Responsibilities

7.6 Exclusions

8. DATA SUBJECT RIGHTS

8.1 Assistance with Data Subject Requests

8.2 Customer Responsibility for Data Subject Requests

8.3 Locktera Processing Limitations and Technical Scope

8.4 Cooperation and Reasonable Assistance

8.5 Legal Requests

8.6 Regulatory Cooperation

9. DATA RETENTION AND DELETION