Data Processing Addendum

Terms used but not defined in this DPA have the meanings given in the Terms of Service or applicable data protection laws ("Data Protection Laws"), including the EU and UK General Data Protection Regulation, the Kenya Data Protection Act, 2019, and the California Consumer Privacy Act (as amended). "Personal Data," "Process," "Controller, " and "Processor" have the meanings given in those laws.

This DPA applies to Twendie's Processing of Customer Personal Data that constitutes personal data under Data Protection Laws. The Controller is the controller of such personal data, and Twendie is the processor. Details of processing (subject matter, duration, nature, purpose, categories of data and data subjects) are set out in Schedule 1.

Twendie will Process Customer Personal Data only on the Controller's documented instructions, including as set out in the Terms of Service, this DPA, and the Controller's configuration of the Service, unless required to do otherwise by applicable law. Twendie will inform the Controller of any such legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest.

Twendie ensures that personnel authorised to Process Customer Personal Data are bound by written confidentiality obligations and have received appropriate training on data protection.

Twendie implements and maintains the technical and organisational measures set out in Schedule 2 to ensure a level of security appropriate to the risk.

The Controller authorises Twendie to engage the sub-processors listed at /sub-processors. Twendie will:

• impose data protection obligations on each sub-processor that are no less protective than those in this DPA;
• remain liable for each sub-processor's performance;
• give the Controller at least 30 days' notice of any addition or replacement of sub-processors (by updating the sub-processor page and, for Customers subscribed to update notifications, by email);
• give the Controller a reasonable opportunity to object on reasonable grounds related to data protection. If the objection cannot be resolved, the Controller may terminate the affected part of the Service for convenience and receive a pro-rata refund of pre-paid unused fees.

Taking into account the nature of the Processing and information available to it, Twendie will assist the Controller (at the Controller's cost where reasonable) in:

• responding to data subject requests (access, rectification, erasure, restriction, portability, objection);
• meeting obligations under Articles 32–36 of the GDPR or equivalent provisions of other Data Protection Laws (security, breach notification, impact assessments, prior consultation).

Twendie will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known, the nature of the breach, categories and approximate number of affected data subjects and records, likely consequences, and measures taken or proposed.

On termination or expiry of the Service, Twendie will, at the Controller's choice, return or delete Customer Personal Data within the periods stated in the Terms of Service and Privacy Policy, except to the extent applicable law requires continued storage.

Twendie will make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA, including a summary of its most recent third-party security audit where available. Audits beyond written information are limited to once per 12 months, on reasonable notice, during business hours, by an independent auditor bound by confidentiality, and not disruptive to the Service. The Controller bears its own costs; additional Twendie costs are payable by the Controller at reasonable rates.

Where Twendie transfers Customer Personal Data out of the EEA, the UK, or another jurisdiction requiring a transfer mechanism, the parties agree that:

• the EU Standard Contractual Clauses (Module 2: Controller to Processor) and, as applicable, the UK International Data Transfer Addendum are incorporated into this DPA by reference, with Twendie as data importer and the Controller as data exporter;
• the optional docking clause, third-party beneficiary rights, and governing-law selections are as set out in the Terms of Service (Kenya) to the extent permitted; otherwise the laws of Ireland apply to the EU SCCs;
• for transfers subject to the Kenya Data Protection Act 2019, the parties rely on contractual safeguards and, where required, authorisation from the Office of the Data Protection Commissioner.

To the extent the CCPA applies, Twendie acts as a " service provider" and will not (a) sell or share Personal Information, (b) retain, use, or disclose Personal Information outside the direct business relationship or for any purpose other than the business purposes specified in the Terms of Service, or (c) combine Personal Information received from the Controller with personal information received from other sources, except as permitted by the CCPA.

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

If there is any conflict between this DPA and the Terms of Service, this DPA prevails to the extent of the conflict, except that the Standard Contractual Clauses prevail over this DPA to the extent of any conflict relating to international transfers.

• Access control: role-based access, unique accounts, mandatory MFA for production access, periodic access review.
• Authentication: passwords stored only as salted hashes; SSO and MFA supported in the application.
• Encryption: TLS 1.2+ in transit; encryption at rest for primary data stores.
• Network security: segmented production network, restricted ingress, web application firewall, DDoS protection at the cloud provider layer.
• Logging and monitoring: centralised logs, automated alerting for anomalous activity.
• Vulnerability management: automated dependency scanning, periodic third-party security testing, patching cadence aligned to severity.
• Backup and recovery: regular encrypted backups with defined retention and tested recovery procedures.
• Secure SDLC: code review, separation of environments, least-privilege CI/CD credentials.
• Incident response: documented playbooks and 72-hour breach notification commitment.
• Personnel: background checks where permitted, confidentiality obligations, security and privacy training.
• Vendor management: due diligence and contractual commitments with sub-processors (see Schedule 3).
• Physical security: production data is hosted by cloud providers whose data centres are physically secured to recognised industry standards.

The current list of authorised sub-processors is maintained at /sub-processors and is incorporated into this DPA by reference.