Data Processing Agreement

1. Scope and instructions

This Data Processing Agreement (“DPA”) forms part of the agreement between WildJS – Tomas Sivicki, Kaiserstrasse 103, 52134 Herzogenrath, Germany, Germany (“Epicat”) and the customer identified in the accepted order (“Customer”), where incorporated into that agreement. Contact legal@epicat.com.

It applies to personal data Epicat processes on Customer's behalf. Customer acts as controller or as a processor authorized by its controller; Epicat acts as processor or subprocessor accordingly. Each party remains responsible for its independent controller activities. GDPR definitions apply.

Epicat will process personal data only on documented instructions, including instructions concerning international transfers, unless Union or Member State law requires otherwise. Where permitted, Epicat will notify Customer before legally required processing. The agreement and authorized configurations constitute instructions within their scope. Epicat will promptly inform Customer if it considers an instruction to infringe applicable data-protection law.

If an instruction cannot lawfully be followed, Epicat may suspend the affected processing while the parties resolve the issue; other obligations remain in force. Customer will provide information reasonably needed for Epicat's processor records and cooperation with competent supervisory authorities. Neither party may instruct the other to disregard a binding legal duty.

2. Processing description

The following schedule defines the permitted processing for the hosted workflow builder. Only operations needed for Customer's enabled features and documented instructions are authorized.

Customer determines its lawful purposes, content and settings and is responsible for required notices and lawful instructions. An order may narrow this schedule. Expanding it to materially different purposes, people, data or sensitive processing requires a documented amendment and any necessary safeguards before that processing starts. This DPA does not authorize independent advertising or general-purpose model training with Customer's personal data.

3. Confidentiality and security

Epicat will restrict access to authorized people who need it for their duties and are subject to confidentiality obligations. It will implement appropriate technical and organizational measures under Article 32 GDPR, considering the nature, scope, context and risks of processing. The agreed measures are specified below; changes must maintain an appropriate level of protection.

4. Assistance and incidents

Taking account of the processing and information available, Epicat will assist Customer with data-subject requests and obligations under Articles 32–36 GDPR, including security, breach response, impact assessments and prior consultation. Requests received concerning Customer data will be forwarded promptly unless prohibited by law; Epicat will not independently respond on Customer's behalf without authorization or a legal obligation.

Any charge for assistance outside the agreed service must be agreed in advance and must not obstruct mandatory assistance, audit or data-subject rights. This DPA does not create an automatic fee for exercising those rights.

Epicat will notify Customer without undue delay after becoming aware of a personal data breach affecting this processing, provide available information about its nature, affected data and individuals, likely consequences, contact and response measures, and supply further information as it becomes available. Customer is responsible for its required notifications. Customer must maintain a monitored incident contact in its account or order.

5. Subprocessors

Customer gives general written authorization for the subprocessors identified in the completed schedule below. Epicat will give advance notice of an intended addition or replacement so Customer can object on reasonable data-protection grounds before processing starts. The parties will seek a compliant alternative; if none is reasonably available, Customer may end the affected service and receive a refund of unused prepaid fees for that service.

Epicat will impose the applicable data-protection obligations on each subprocessor by written agreement and remains responsible to Customer for their performance. Customer-selected connections must be classified by their actual contractual role rather than automatically treated as Epicat subprocessors. On request, Epicat will provide the information needed to assess those obligations, including relevant subprocessor agreement provisions, with redactions limited to protecting unrelated confidential information or personal data.

[PROVIDERS_AND_LOCATIONS]: complete the authorized subprocessor schedule with each legal entity, service, personal data, processing countries and transfer basis. Identify any separate controller recipients in the Privacy policy. A draft vendor list is not authorization to use an undisclosed subprocessor.

6. Transfers, audits and deletion

Restricted international transfers require a valid legal basis. [TRANSFER_SAFEGUARDS] must identify applicable adequacy decisions or executed standard contractual clauses, relevant modules and annexes, supplementary measures and any required UK or Swiss adaptations. Linking to uncompleted clauses does not execute them.

This DPA does not by itself supply an international-transfer mechanism. Any applicable transfer clauses must be completed and made binding on the correct parties; their mandatory protections are not reduced by this DPA or the Terms.

Epicat will provide information necessary to demonstrate Article 28 compliance and allow and contribute to audits, including inspections, by Customer or its authorized auditor. Reasonable confidentiality, notice and security arrangements must not frustrate those rights or regulatory requirements.

If Epicat cannot comply with this DPA, it will inform Customer promptly. Customer may instruct suspension of the affected processing until compliance is restored and retains the right to terminate the affected processing agreement where the breach is material or persistent, or compliance cannot be restored within a reasonable period. Return, deletion and mandatory legal obligations continue to apply.

At the end of processing, Epicat will, at Customer's choice, return or delete personal data and delete existing copies, unless Union or Member State law requires retention. Retained data stays protected and restricted to that legal purpose. [EXPORT_AND_DELETION] must specify export format, return and deletion periods, backup expiry, provider deletion and confirmation. The schedule must agree with the Privacy policy's retention information.

7. Technical and organizational measures

[SECURITY_MEASURES]: attach the dated measures actually implemented for the agreed processing, covering access and tenant separation, transport and storage protection, credential/key handling, logging, vulnerability and incident management, backups and restoration, deletion and supplier oversight. Identify Customer's configuration responsibilities. Planned controls or a provider's certification must not be represented as verified Epicat protections.

8. Priority and acceptance

This DPA prevails over conflicting service terms concerning this processing. Mandatory transfer instruments and statutory rights prevail where required. Liability otherwise follows the Terms, without restricting Article 82 GDPR. This DPA continues until the required return or deletion is complete. The parties must complete the relevant schedules and document acceptance before relying on this draft for customer processing.