Data Processing Agreement

01Definitions and roles

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given in the GDPR (Regulation (EU) 2016/679). With respect to personal data processed through the Platform, the Customer is the controller and GreenMesh is the processor. Where the Customer is itself a processor for a third-party controller, GreenMesh acts as a sub-processor and this DPA applies accordingly.

02Subject-matter and instructions

GreenMesh processes personal data only on documented instructions from the Customer, including as set out in this DPA and the Principal Agreement, unless required to do otherwise by EU or Member-State law (in which case GreenMesh will inform the Customer, unless legally prohibited). The subject-matter, duration, nature, and purpose of processing, and the categories of data and data subjects, are described in Annex 1.

03Duration

This DPA applies for as long as GreenMesh processes personal data on behalf of the Customer under the Principal Agreement.

04Confidentiality

GreenMesh ensures that persons authorised to process the personal data are bound by appropriate confidentiality obligations and are subject to access controls on a need-to-know basis.

05Security measures

GreenMesh implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the nature of the processing, in accordance with Article 32 GDPR. The measures are described in Annex 2.

06Sub-processors

The Customer grants GreenMesh general authorisation to engage sub-processors, subject to the following. GreenMesh:

• maintains the list of sub-processors in Annex 3 and informs the Customer of any intended addition or replacement at least 30 days in advance, giving the Customer the opportunity to object on reasonable data-protection grounds;
• imposes on each sub-processor, by written contract, data-protection obligations equivalent to those in this DPA; and
• remains fully liable to the Customer for the performance of each sub-processor's obligations.

07Assistance to the Customer

Taking into account the nature of the processing, GreenMesh assists the Customer by appropriate technical and organisational measures, insofar as possible, to:

• respond to requests from data subjects exercising their rights under Chapter III GDPR; and
• ensure compliance with the Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the information available to GreenMesh.

08Personal data breaches

GreenMesh notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's personal data, and provides the information reasonably required to enable the Customer to meet its breach-notification obligations under Articles 33 and 34 GDPR.

09International transfers

The Platform is hosted on Amazon Web Services. Customer Data is hosted primarily in the European Union (Germany). Certain services or backups may involve processing in the United States or Australia. Where personal data is transferred outside the European Economic Area, GreenMesh ensures a valid Chapter V GDPR transfer mechanism is in place — the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the recipient is certified, and additional safeguards where required. GreenMesh does not otherwise transfer the Customer's personal data outside the EEA except on the Customer's instruction or as necessary to provide the Platform.

10Return and deletion

On termination of the Principal Agreement, GreenMesh, at the Customer's choice, deletes or returns the personal data and deletes existing copies, unless EU or Member-State law requires storage. The Customer may export Customer Data within 30 days of termination.

11Audits

GreenMesh makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, on at least 30 days' prior written notice, no more than once per year (except where required by a supervisory authority or following a personal data breach), during business hours, subject to confidentiality and without compromising the security of other customers.

12Liability and miscellaneous

Liability under this DPA is subject to the limitations agreed in the Principal Agreement, to the extent permitted by law. If there is a conflict between this DPA and the Principal Agreement on data-protection matters, this DPA prevails. This DPA is governed by the law of the Republic of Slovenia.