MERCURIUS OS

Data Processing Agreement — Mercurius OS

Part of the Agreement between Incapital B.V. (trading as Mercurius OS, Chamber of Commerce no. 62844768, hereinafter: the "Processor") and the Customer (hereinafter: the "Controller"), as referred to in Article 28 GDPR.

1. Roles and subject matter

• 1. The Customer determines the purposes and means of the processing and is the Controller; Mercurius processes personal data solely on behalf of the Customer for the provision of the Service.
• 2. Mercurius does not process the personal data for its own purposes and not to train third-party AI models.

2. Which processing operations

(Once the customer contact/inbox module goes live, this table will be extended with messages from the Customer's customers; that requires a revised version.)

3. Instructions

• 1. Mercurius processes only on the basis of written instructions from the Customer (including: the operation of the Service as agreed).
• 2. If, in Mercurius' opinion, an instruction infringes the GDPR, Mercurius will notify the Customer immediately.

4. Confidentiality

Persons who process personal data under Mercurius' authority are bound by a duty of confidentiality.

5. Security

Mercurius takes appropriate technical and organisational measures, including:

• encrypted connections (TLS) and encrypted storage at the hosting providers;
• strict separation of customer data (row level security per customer);
• access management with personal accounts and login links without shared passwords;
• tokens and keys exclusively server-side, never in the browser;
• logging of actions in an audit log;
• daily automated monitoring of connections and publications.

6. Sub-processors

• 1. The Customer gives general authorisation for the engagement of sub-processors. Mercurius informs the Customer of changes; the Customer may object on reasonable grounds within 14 days.
• 2. Current sub-processors:

• 3. Mercurius imposes obligations on sub-processors that are equivalent to those in this agreement.

7. Transfers outside the EEA

Transfers to countries outside the EEA take place only with appropriate safeguards (EU-US Data Privacy Framework and/or EU standard contractual clauses).

8. Personal data breaches

• 1. Mercurius informs the Customer without undue delay, at the latest within 48 hours after discovering a personal data breach, with the information the Customer needs for any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects.
• 2. Notifying the supervisory authority and data subjects is the Customer's responsibility; Mercurius provides all reasonable assistance.

9. Rights of data subjects

Mercurius assists the Customer, as far as possible, with requests from data subjects (access, rectification, erasure, objection) and forwards requests received directly to the Customer without delay.

10. Audit

• 1. On request, Mercurius makes available information that allows the Customer to verify compliance with this agreement.
• 2. At most once a year, the Customer (or an independent auditor) may carry out an audit, after reasonable notice and at its own expense.

11. Term and termination

• 1. This agreement applies for as long as the Service is provided.
• 2. After termination, Mercurius deletes all of the Customer's personal data within 30 days, or first returns it as an export on request — subject to statutory retention obligations.

12. Liability and order of precedence

• 1. The liability provisions of the General Terms and Conditions also apply to this agreement.
• 2. In the event of a conflict between this agreement and the General Terms and Conditions, this agreement prevails as regards the processing of personal data.