Data Processing Addendum

Effective Date: October 5, 2026
Last Updated: October 5, 2026

This Data Processing Addendum ("DPA") forms part of the Dunyo Terms of Service (the "Agreement") between Dunyo, Inc., a Delaware corporation ("Dunyo", "we", "us"), and the customer that has accepted the Agreement ("Customer", "you"). It governs how Dunyo processes Personal Data on Customer's behalf when providing the Dunyo platform (the "Service").

This DPA takes effect automatically when Customer accepts the Agreement; no signature is required. A Customer that needs a countersigned copy may request one at [email protected].

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement.

• "Data Protection Laws" means all laws that apply to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA").
• "Personal Data" means any information relating to an identified or identifiable natural person that Dunyo processes on Customer's behalf through the Service ("Customer Personal Data").
• "Controller", "Processor", "Data Subject", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider" and "Sell" / "Share" have the meanings given in the CCPA.
• "Subprocessor" means any third party engaged by Dunyo to process Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the clauses approved by European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

2. Roles and scope

2.1 Roles. Customer is the Controller of Customer Personal Data and Dunyo is its Processor. Under the CCPA, Customer is the Business and Dunyo is its Service Provider. Where Customer itself acts as a Processor for a third party, Dunyo acts as Customer's Subprocessor.

2.2 Dunyo as Controller. This DPA does not cover Personal Data that Dunyo processes as an independent Controller, such as account and billing contacts, website visitors, and security logs used to operate and secure the Service. That data is governed by the Dunyo Privacy Policy.

2.3 Details of processing. The subject matter, duration, nature, purpose, data categories and Data Subjects are described in Annex I.

2.4 Customer responsibilities. Customer is responsible for the lawfulness of the Personal Data it submits to the Service, including having a lawful basis for processing and giving any notices to its personnel that Data Protection Laws require. Apart from absence types such as sick leave, Customer will not submit special categories of Personal Data (such as health details or biometric data) to the Service.

3. Processing instructions

3.1 Dunyo will process Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. Additional instructions require written agreement.

3.2 Dunyo will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, unless the law prohibits it from doing so.

3.3 Dunyo will not Sell or Share Customer Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, or combine it with personal data from other sources except as Data Protection Laws permit. Dunyo will not use Customer Personal Data to train machine learning or AI models. Dunyo will notify Customer if it can no longer meet its obligations under the CCPA.

4. Confidentiality

Dunyo will ensure that everyone it authorizes to process Customer Personal Data is bound by an appropriate duty of confidentiality and has access only to the extent needed to provide the Service.

5. Security

Dunyo will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II. Dunyo may update these measures over time, provided the overall level of protection is not reduced.

6. Subprocessors

6.1 Authorization. Customer gives general authorization for Dunyo to engage Subprocessors. The current list is in Annex III.

6.2 Obligations. Dunyo will bind each Subprocessor by a written contract with data protection obligations no less protective than this DPA, and remains liable to Customer for each Subprocessor's performance.

6.3 Changes. Dunyo will notify Customer of any new or replacement Subprocessor at least 14 days before it begins processing, by updating Annex III and emailing Customer's account owner. If a replacement is urgently needed for security, availability or legal reasons, such as a Subprocessor ceasing operations, Dunyo may make it sooner and will notify Customer as soon as reasonably possible. Customer may object on reasonable data protection grounds within 14 days of the notice by writing to [email protected]. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused term.

7. Data Subject requests

The Service lets Customer access, correct and delete Customer Personal Data. If Dunyo receives a request from a Data Subject relating to Customer Personal Data, it will redirect the requester to Customer and will not respond itself except on Customer's instruction. Dunyo will provide reasonable assistance where Customer cannot fulfil a request using the Service.

8. Personal Data Breaches

8.1 Dunyo will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach.

8.2 The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Dunyo will supplement the information as it becomes available and take reasonable steps to contain and remediate the breach.

8.3 Notifying Customer of a breach is not an admission of fault or liability by Dunyo.

9. Assistance

Taking into account the nature of the processing, Dunyo will provide reasonable assistance to Customer with data protection impact assessments, prior consultations with Supervisory Authorities, and Customer's other obligations under Data Protection Laws, to the extent Customer cannot meet them through the Service or this DPA.

10. Return and deletion

10.1 On request during the subscription term, or within 30 days after the Agreement ends, Dunyo will provide an export of Customer Personal Data in a commonly used, machine-readable format.

10.2 When the 30-day export period in Section 10.1 ends, Dunyo will delete Customer Personal Data, and backup copies will be overwritten within a further 60 days in the ordinary course. Dunyo may retain data where required by law, and will keep any retained data confidential and process it only for that legal purpose.

11. Audits

11.1 Dunyo will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including completing reasonable security questionnaires no more than once a year.

11.2 If that information is not sufficient, or a Supervisory Authority requires it, Customer may conduct an audit, at its own cost, on at least 30 days' written notice, during business hours, no more than once in any 12 months, and subject to reasonable confidentiality and security controls. Audits will be conducted remotely where possible and must not unreasonably disrupt Dunyo's operations.

12. International transfers

12.1 Location. Customer Personal Data is hosted in the United States. Dunyo personnel may access it from Uzbekistan to provide support and operate the Service, and Subprocessors may process it in the countries listed in Annex III, all subject to this Section 12.

12.2 EEA transfers. To the extent Customer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two (Controller to Processor) applies where Customer is a Controller, and Module Three (Processor to Processor) applies where Customer is a Processor; Clause 7 (docking clause) applies; Clause 9 Option 2 (general authorization) applies, with the notice period in Section 6.3; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and resolved in the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

12.3 UK transfers. For transfers from the United Kingdom, the UK Addendum applies and is incorporated by reference. Table 1 is completed with the parties' details in Annex I, Table 2 by Section 12.2, Table 3 by Annexes I to III, and in Table 4 either party may end the UK Addendum as set out in its Section 19.

12.4 Swiss transfers. For transfers from Switzerland, the SCCs apply as set out in Section 12.2, with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority, and "Member State" including Switzerland so Data Subjects there may bring claims in their place of habitual residence.

12.5 Data Privacy Framework. If Dunyo or a Subprocessor is certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, that certification may be relied on as the transfer mechanism in place of the SCCs for the relevant transfers.

12.6 Conflict. If the SCCs or UK Addendum conflict with this DPA, the SCCs or UK Addendum prevail.

12.7 Government access requests. If Dunyo receives a legally binding request from a public authority for Customer Personal Data, it will, unless legally prohibited, promptly notify Customer, assess the legality of the request, challenge it where there are reasonable grounds to do so, and disclose only the minimum data required.

13. Liability

Each party's liability arising out of or relating to this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Agreement, except to the extent such limitation is prohibited by Data Protection Laws or the SCCs.

14. Term, precedence and changes

14.1 This DPA stays in effect for as long as Dunyo processes Customer Personal Data, and ends automatically once all of it has been deleted under Section 10.

14.2 If this DPA conflicts with the Agreement, this DPA prevails with respect to the processing of Customer Personal Data.

14.3 Dunyo may update this DPA to reflect changes in Data Protection Laws, the Service or its Subprocessors, by posting the updated version at dunyo.app and notifying Customer at least 30 days before material changes take effect. No update will materially reduce the protection given to Customer Personal Data.

14.4 If any provision of this DPA is held invalid, the rest remains in effect.

15. Governing law

Except where the SCCs or Data Protection Laws require otherwise, this DPA is governed by the law and venue specified in the Agreement.

16. Contact

Questions about this DPA, objections to Subprocessors, and requests for a signed copy go to Dunyo, Inc. at [email protected] or 651 N Broad St, Suite 201, Middletown, DE 19709.

Annex I: Details of processing

Annex II: Technical and organizational security measures

• Encryption in transit: all traffic to the Service uses TLS 1.2 or higher.
• Encryption at rest: file attachments are stored in encrypted object storage; databases and backups run on access-restricted infrastructure.
• Authentication: passwords are stored only as salted hashes; the Service supports TOTP two-factor authentication, passkeys (WebAuthn) and Google sign-in; sessions use HttpOnly, Secure cookies.
• Access control: workspace roles limit what each member can see and change; Dunyo staff access production data only when needed to provide support or the Service, using individual accounts with two-factor authentication.
• Environment separation: production is separated from staging and development; non-production environments are protected behind zero-trust access controls and do not use Customer Personal Data except demo data.
• Logging and monitoring: application, infrastructure and security events are logged and monitored with alerting; workspace changes are recorded in an audit log available to Customer.
• Availability and resilience: regular automated backups, documented restore procedures, and a public status page.
• Secure development: automated tests and dependency review on every change, and automated deployment pipelines.
• Vendor management: Subprocessors are reviewed for security and bound by written data protection terms.
• Incident response: a documented process to detect, contain, investigate and notify Personal Data Breaches under Section 8.
• Personnel: confidentiality obligations and least-privilege access for everyone with access to Customer Personal Data.

Annex III: Subprocessors

Dunyo will update this list at least 14 days before adding or replacing a Subprocessor, except in the urgent cases described in Section 6.3.