Data Processing Agreement

2.1. Process only on Instructions: Process the Personal Data only on the documented Instructions of the Data Controller for the Permitted Purposes, unless required to do so by EU or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.2. International Transfers: Not transfer Personal Data outside the European Economic Area (EEA) without the prior written consent of the Data Controller and only on the basis of appropriate safeguards in accordance with Data Protection Laws (e.g., Standard Contractual Clauses).

2.3. Confidentiality: Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.4. Security of Processing: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate the measures described in Article 32 of the GDPR (e.g., pseudonymisation, encryption, confidentiality, integrity, availability, and resilience). A summary of security measures is available at [Link to Polygon Digital Security Documentation].

2.5. Sub-processing: Not engage another processor (Sub-processor) without prior specific or general written authorisation of the Data Controller.

2.6. Data Subject Rights: Assist the Data Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Data Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR (right of access, rectification, erasure, restriction, etc.).

2.7. Assistance with Compliance: Taking into account the nature of processing, assist the Data Controller in ensuring compliance with its obligations relating to security of processing (Art. 32), notification of Personal Data Breaches (Arts. 33, 34), and data protection impact assessments (Art. 35), as necessary and reasonable.

2.8. Breach Notification: Notify the Data Controller without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting the Data Controller’s data. Such notification shall include, at a minimum, the information required under Article 33(3) of the GDPR.

2.9. Engagement with Supervisory Authority: Make available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to audits, including inspections, conducted by the Data Controller or another auditor mandated by the Data Controller. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.