1Definitions

The terms used in this DPA shall have the meanings set forth below. Capitalized terms not otherwise defined herein shall have the meaning set forth in the Agreement.

• "Applicable Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Processor on behalf of Controller in connection with the Service.
• "Data Subject" means the individual to whom Personal Data relates.
• "Sub-processor" means any third party appointed by or on behalf of Processor to process Personal Data on behalf of Controller in connection with the Agreement.

2Scope and Applicability

2.1 Role of the Parties

The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller (the entity that determines the purpose and means of processing) and Wezard is the Processor (the entity that processes data on behalf of the Controller).

2.2 Subject Matter

The subject matter of the processing is the provision of the Wezard B2B SaaS platform, including capturing, structuring, and routing bug reports and feedback to Third-Party Integrations (Jira, ServiceNow, Azure DevOps).

2.3 Duration

The processing will be carried out for the duration of the Agreement plus the 60-day Retention Period specified in the ToS.

3CCPA/CPRA Specific Provisions

As Wezard provides services to California-based clients, the following "Service Provider" restrictions apply:

3.1 Prohibitions

Processor is prohibited from:

• Selling or Sharing Personal Data (as those terms are defined in the CCPA/CPRA).
• Retaining, using, or disclosing Personal Data for any purpose other than for the specific business purpose of performing the Services.
• Retaining, using, or disclosing Personal Data outside of the direct business relationship between Processor and Controller.
• Combining Personal Data received from Controller with Personal Data received from other sources, except as permitted by the CCPA/CPRA.

3.2 Certification

Processor certifies that it understands the restrictions set forth in Section 3.1 and will comply with them.

4Processor Obligations

4.1 Instructions

Processor shall process Personal Data only on the documented instructions of Controller, including with regard to transfers of Personal Data to a third country or an international organization.

4.2 Confidentiality

Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security

Taking into account the state of the art and the nature of processing, Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include, but are not limited to:

• Encryption of data at rest and in transit.
• Access controls to ensure only authorized personnel have access to data.
• Regular vulnerability scanning (internal) to maintain system integrity.

A detailed description of the technical and organizational measures applicable to the Wezard SaaS Platform is set forth in Annex 2 (Security Controls and Compliance References).

4.4 Sub-processors

Controller grants a general authorization to Processor to engage Sub-processors (such as cloud hosting providers or integrated bug-tracking tools). Processor shall:

• Maintain an up-to-date list of Sub-processors.
• Enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those in this DPA.
• Remain fully liable to Controller for the performance of the Sub-processor's obligations.

5Data Subject Rights

5.1 Assistance

Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests for exercising Data Subject rights (e.g., requests for access, deletion, or portability).

5.2 Notification

If Processor receives a request from a Data Subject directly, Processor shall notify Controller without undue delay and advise the Data Subject to submit their request to Controller.

6Personal Data Breach

6.1 Notification

Processor shall notify Controller without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach.

6.2 Content of Notification

The notification shall, at a minimum:

• Describe the nature of the Personal Data Breach.
• Describe the categories and approximate number of Data Subjects concerned.
• Describe the measures taken or proposed to be taken by Processor to address the breach.

7Audit and Inspection

7.1 Compliance

Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA.

7.2 Audit Rights

Once per year, Controller may request a summary of Processor's security certifications or reports. If Controller has a reasonable belief that Processor is in breach of this DPA, Controller may conduct an audit of Processor's processing facilities at Controller's expense, provided that the parties agree on the scope and timing of such audit to avoid disruption to Processor's business.

8Termination and Deletion

8.1 Return or Deletion

Upon termination of the Agreement, and consistent with the ToS, Processor shall:

• Maintain Personal Data for sixty (60) days to allow Controller to export the data.
• After sixty (60) days, delete all existing copies of Personal Data unless Applicable Data Protection Laws require continued storage.

9International Data Transfers and Data Residency

9.1 Hosting Location

Personal Data processed by Processor on behalf of Controller is hosted on Microsoft Azure infrastructure within the United States. Hosting regions are assigned based on the Controller's subscription tier and customer classification:

• Commercial Customers: Microsoft Azure East US and East US 2 regions.
• U.S. Government Customers: Microsoft Azure Government USGov Virginia region.

Backup snapshots are stored in Azure Blob Storage within the same regional boundary as the source database. Personal Data does not leave the assigned regional boundary except as expressly authorized by the Controller (for example, where the Controller configures routing to a Third-Party Integration hosted outside of the assigned region).

9.2 Cross-Border Transfers

Where the Controller is established outside the United States, or where Personal Data of Data Subjects located outside the United States is processed, the transfer of such Personal Data to Processor's U.S.-based infrastructure constitutes a cross-border transfer. Processor implements the following safeguards:

• Standard Contractual Clauses (SCCs): For Controllers established in the EEA or the United Kingdom, the parties shall be deemed to have executed the relevant Module of the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where applicable, the United Kingdom International Data Transfer Addendum issued by the Information Commissioner's Office.
• Supplementary Measures: Processor applies supplementary technical measures to all cross-border transfers, including encryption of data in transit using TLS 1.2 or higher, encryption of data at rest using AES-256, and access controls limiting Sub-processor access to the minimum necessary to provide the Service.
• Onward Transfers: Sub-processors located outside the United States are engaged only where they have provided contractual commitments substantively equivalent to those imposed on Processor under this Section 9.

9.3 Routing to Third-Party Integrations

Where Controller configures the Wezard Platform to route Personal Data to a Third-Party Integration (such as Jira, ServiceNow, or Azure DevOps) hosted in a region outside the assigned hosting region, Controller acknowledges that such onward routing is performed at Controller's direction and that Controller is responsible for ensuring an adequate legal basis for the resulting transfer.

Annex 1: Details of Processing

A. List of Parties

• Controller: The Customer entity identified in the Order Form.
• Processor: Wezard, a US-based SaaS startup.

B. Description of Processing

• Categories of Data Subjects: Customer's employees, contractors, and end-users who report bugs or provide product feedback.
• Categories of Personal Data: Name, business email address, job title, and phone number (for SMS/text alerts). No sensitive or "Special Category" data is intended to be processed.
• Nature of Processing: Collection, organization, structuring, storage, and transmission (routing) to third-party issue trackers (Jira, ServiceNow, Azure DevOps).

C. Technical and Organizational Measures

Processor maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of Personal Data. This includes firewalls, multi-factor authentication (MFA) for administrative access, and secure API protocols for third-party syncing. A detailed description of the controls applicable to the Wezard SaaS Platform is set forth in Annex 2.

Annex 2: Security Controls and Compliance References

This Annex describes the principal technical and organizational measures implemented by Processor to protect Personal Data processed in connection with the Wezard SaaS Platform (the "Platform").

A. Compliance Attestations

A.1 SOC 2 Reference

Processor has obtained a SOC 2 attestation report covering a related infrastructure environment operated by Wezard. The Platform that is the subject of this DPA shares control objectives, governance processes, and security principles with the SOC 2-attested environment, including those relating to access control, change management, encryption, vendor management, and incident response.

A copy of the SOC 2 attestation report is available to Controllers on request and subject to execution of a mutually acceptable non-disclosure agreement.

B. Technical Controls Applicable to the Platform

B.1 Encryption

• Data in transit is encrypted using TLS 1.2 or higher between client applications, the Platform, and Sub-processors.
• Data at rest, including database storage and backup snapshots, is encrypted using AES-256.

B.2 Authentication and Access Control

• Role-Based Access Control (RBAC) for Customer administrators and end users.
• Single Sign-On (SSO) integration with Customer-managed identity providers.
• Multi-Factor Authentication (MFA) for administrative access to the Platform and for end users where enforced by the Customer.
• Principle of least privilege applied to internal Wezard personnel; production access restricted to authorized engineering and operations personnel.

B.3 Tenant Architecture and Isolation

The Platform is deployed as a multi-tenant SaaS service. Tenant separation is enforced at the application and database layer rather than through physically segregated infrastructure per Customer. Controls applied to maintain tenant isolation include:

• Logical tenant identifiers enforced on all read and write operations.
• Application-layer authorization checks designed to prevent cross-tenant data access.
• Monitoring and alerting for anomalous access patterns indicative of cross-tenant access attempts.

Controller acknowledges that, because the Platform is multi-tenant, infrastructure components such as compute, database, and storage resources are shared across Customers within the same regional boundary.

B.4 Hosting Infrastructure

The Platform is hosted on Microsoft Azure within the regions identified in Section 9.1. The application tier runs on virtual machines, with the production database deployed on PostgreSQL hosted within a virtual machine instance. The Platform does not, as of the Effective Date, operate behind a dedicated managed load balancer in the same configuration as the SOC 2-attested environment; Customers requiring a specific load-balancing or high-availability configuration should consult with Processor regarding feasibility prior to subscribing.

B.5 Backups and Recovery

• Automated daily backups of the production database via scripted backup routines.
• Backup snapshots written to Azure Blob Storage within the same regional boundary as the source database.
• Backup retention aligned with the data retention periods set forth in the Privacy Policy and Section 8 of this DPA.

B.6 Logging and Monitoring

• System, application, and access logs are generated for the Platform and retained for thirty (30) days.
• Logs are monitored for security events, including unauthorized access attempts and abnormal data access patterns.
• Customers requiring extended log retention must export the relevant logs from the Wezard portal prior to expiration of the 30-day window.

B.7 Vulnerability Management

• Internal vulnerability scanning is performed on a regular basis.
• Identified vulnerabilities are triaged according to severity and remediated within commercially reasonable timeframes.
• Unauthorized stress testing, penetration testing, or scanning by Customers or third parties is prohibited under the Terms of Service.

C. Organizational Controls

• Personnel with access to Personal Data are subject to written confidentiality obligations.
• Security awareness training is provided to personnel with access to production systems.
• Sub-processor engagements are subject to a vendor risk review and a written data protection agreement no less protective than this DPA.
• Incident response procedures are maintained to support the breach notification obligations set forth in Section 6.

D. Summary Control Matrix

End of Annex 2