rConfig Data Processing Addendum (DPA)

Version 2.0 Last Updated: 1st January 2026

---

Parties

This Data Processing Addendum ("DPA") is made between:

OS Informatics Limited, trading as rConfig, a company incorporated in Ireland under company number 751053, with its registered office at 44 Longshore Drive, Jacobs Island, Cork, Ireland ("rConfig"); and

the customer identified in the Agreement ("Customer").

Each a "party" and together the "parties".

---

1. Scope, Incorporation, and Precedence

1.1 Incorporation

This DPA forms part of and is incorporated into the Agreement. Where the Agreement incorporates this DPA by reference, this DPA applies without further signature. Either party may require the other to execute this DPA as a signed document, and the signature block at the end of this DPA is provided for that purpose.

1.2 Precedence

This DPA prevails over the Agreement to the extent of any conflict concerning the processing of Personal Data. In all other respects the Agreement prevails, including in respect of the limitation of liability, subject to Section 13.

Where the parties execute the Standard Contractual Clauses under Section 9, those clauses prevail over this DPA to the extent of any conflict, save that nothing in this DPA is to be read as reducing the protections afforded by them.

1.3 What This DPA Covers

This DPA governs rConfig's processing of Personal Data as a processor on Customer's behalf, being:

• Personal Data contained within Customer's rConfig environment, or within diagnostic material derived from it, to which rConfig obtains access in the course of providing Support or Professional Services; and
• any other Personal Data that Customer instructs rConfig in writing to process on its behalf.

1.4 What This DPA Does Not Cover

This DPA does not govern:

• rConfig's processing of business contact and account data as an independent controller, which is addressed in Section 3.3 and in the Privacy Policy;
• telemetry and diagnostic data that rConfig processes as a controller, which is addressed in Section 11.1;
• data that Customer transmits to a Model Provider through an AI Feature, which is addressed in Section 11.2;
• operational data held within Customer's own environment to which rConfig has no access, which is addressed in Section 11.3; or
• any use of rConfig Core under the GNU General Public License version 3, where no commercial agreement exists between the parties and rConfig performs no processing on any person's behalf.

1.5 Application

This DPA applies to the extent that rConfig processes Personal Data to which Data Protection Law applies.

---

2. Definitions and Interpretation

"Agreement" means the rConfig software licence agreement, product schedule, add-on agreement, master services agreement, order, or statement of work in force between the parties, including as applicable the Professional Edition EULA, the Enterprise Edition EULA, the Vector MSP Edition EULA, the Vector Agent Product Schedule, the Vector Prism Product Schedule, and the Automate Add-On Agreement.

"Data Protection Law" means all laws applicable to the processing of Personal Data under this DPA, including Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, the UK GDPR and the UK Data Protection Act 2018 where applicable ("UK Data Protection Law"), the Swiss Federal Act on Data Protection where applicable, and any national implementing or supplementary legislation.

"EEA" means the European Economic Area.

"End Client" has the meaning given in the Vector MSP Edition EULA.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by rConfig under this DPA.

"Restricted Transfer" means a transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to a country not benefiting from an adequacy decision applicable to that transfer.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.

"Sub-Processor" means any third party engaged by rConfig to process Personal Data under this DPA.

"Support" means technical support and maintenance services under the Agreement, and includes Professional Services and Automate where those involve access to Personal Data.

"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0.

"controller", "processor", "sub-processor", "data subject", "personal data", "processing", "special categories of personal data", and "supervisory authority" have the meanings given in GDPR, and "Personal Data" means personal data as so defined.

In this DPA, "including" is to be read as if followed by "without limitation", and a reference to a statute or instrument is a reference to it as amended, extended, replaced, or re-enacted from time to time.

---

3. Roles of the Parties

3.1 rConfig as Processor

In respect of the processing described in Section 1.3, Customer is the controller and rConfig is the processor.

Where Customer is itself a processor acting on behalf of a third party, including an End Client, Customer is the processor and rConfig is a sub-processor. Section 12 applies in that case, and Customer warrants that it has the authority of the relevant controller to appoint rConfig on the terms of this DPA.

3.2 Self-Hosted Deployment

The rConfig platform is deployed and operated within infrastructure controlled by Customer, whether on-premises, in Customer's private cloud, or in a public cloud account owned by Customer. rConfig does not host the platform and has no routine or standing access to Customer's environment or to the data within it.

It follows that rConfig performs no processing of Personal Data in Customer's operational environment except where Customer grants rConfig access for a specific Support purpose, at which point Section 7 applies.

The parties record that this is a description of the deployment model and is not a characterisation of any data as falling outside Data Protection Law.

3.3 rConfig as Independent Controller

rConfig acts as an independent controller, and not as Customer's processor, in respect of the business contact and account data it processes for its own purposes, being the names, business email addresses, business telephone numbers, job titles, organisation names, licence and entitlement identifiers, support ticket metadata, and billing and procurement contact details of Customer's personnel.

rConfig processes that data for contract administration, entitlement and licence management, invoicing and credit control, provision and routing of Support, delivery of security and End-of-Life notices, and compliance with its legal obligations, on the legal bases set out in the Privacy Policy.

That processing is not governed by this DPA. Each party is independently responsible for its own compliance in respect of it, and neither party is the other's processor for that purpose.

3.4 Personal Data Within Infrastructure Data

The parties acknowledge that configuration files, device inventories, logs, and other infrastructure data managed by the platform may contain Personal Data, including local and administrative account names, contact addresses configured on devices, directory service bind accounts, authentication server user records, certificate subject names, and access control entries naming individuals.

Customer determines what data is held in its environment and is responsible for its lawfulness. Where rConfig obtains access to such data under Section 7, rConfig processes it as Customer's processor.

---

4. Description of the Processing

The following particulars are required by Article 28(3) GDPR and are set out in full in Annex I.

Subject matter. The provision of Support and, where applicable, Professional Services in respect of the rConfig platform.

Duration. For the term of the Agreement, and thereafter only for the period permitted by Section 5.8.

Nature and purpose. Diagnosis, reproduction, and resolution of technical issues; validation of configuration and integration behaviour; performance of work under a statement of work; and such other purposes as Customer instructs in writing. Processing operations comprise access, viewing, collection, storage, retrieval, analysis, transmission between authorised personnel, and deletion.

Categories of Personal Data. As set out in Annex I, Section B. rConfig does not require and does not seek special categories of Personal Data, and Customer must not submit them.

Categories of data subjects. As set out in Annex I, Section B.

---

5. rConfig's Obligations as Processor

5.1 Processing on Instructions

rConfig will process Personal Data only on Customer's documented instructions, including with regard to any Restricted Transfer, unless required to do otherwise by law to which rConfig is subject. Where rConfig is so required, it will inform Customer of that legal requirement before processing, unless prohibited from doing so by law.

The Agreement, this DPA, each support request or statement of work raised by Customer, and any written instruction Customer gives to rConfig's Support function constitute Customer's documented instructions.

rConfig will not process Personal Data for its own purposes, will not sell it, and will not use it to train or fine-tune any machine learning model.

5.2 Unlawful Instructions

rConfig will inform Customer without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is confirmed, amended, or withdrawn.

5.3 Confidentiality of Personnel

rConfig will ensure that each person it authorises to process Personal Data is subject to a binding obligation of confidentiality, is informed of the confidential nature of the data, receives appropriate data protection training, and accesses Personal Data only to the extent necessary to perform their role.

rConfig will limit access to Personal Data to those personnel who need it for the purposes of Section 1.3, and will maintain a record of authorised personnel.

5.4 Security

rConfig will implement and maintain the technical and organisational measures set out in Annex II, having regard to the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks to data subjects.

rConfig may update those measures from time to time provided that the level of protection is not materially reduced.

5.5 Assistance with Data Subject Rights

Where rConfig receives a request from a data subject relating to Personal Data processed under this DPA, rConfig will not respond to it substantively but will notify Customer without undue delay and will forward the request.

rConfig will provide Customer with reasonable assistance, at Customer's cost where the assistance is more than nominal, in responding to requests for access, rectification, erasure, restriction, portability, or objection, taking into account the nature of the processing and the fact that Customer holds the operational data in its own environment and is ordinarily able to respond without rConfig's involvement.

5.6 Assistance with Articles 32 to 36

rConfig will provide Customer with reasonable assistance, at Customer's cost where the assistance is more than nominal, in respect of:

• Customer's obligations to maintain the security of processing under Article 32;
• notification of a Personal Data Breach to a supervisory authority or to data subjects under Articles 33 and 34;
• a data protection impact assessment under Article 35; and
• prior consultation with a supervisory authority under Article 36.

5.7 Records

rConfig will maintain records of its processing categories and activities under this DPA sufficient to demonstrate compliance with Article 30(2), and will make them available to Customer on reasonable request under Section 6.

5.8 Deletion and Return

On the earlier of Customer's written request and the date thirty (30) days after the end of the provision of Support under the Agreement, rConfig will, at Customer's option, delete or return all Personal Data processed under this DPA, and will delete all existing copies.

Where diagnostic material has been provided to rConfig for a specific support request, rConfig will delete it within ninety (90) days of closure of that request, or within such shorter period as Customer specifies in writing.

rConfig may retain Personal Data to the extent and for so long as required by law, or where it is held in routine encrypted backups that cannot reasonably be selectively purged, in which case rConfig will not process it for any other purpose and will delete it on expiry of the applicable backup cycle. rConfig will certify deletion in writing on request.

5.9 Contact Point

rConfig's contact point for data protection matters is privacy@rconfig.com. rConfig will notify Customer of any change.

---

6. Audit and Information Rights

6.1 Information

rConfig will make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 and with this DPA, including by completing a reasonable security or data protection questionnaire and by providing any then-current third-party certification, attestation, or assessment report it holds.

rConfig will respond to a reasonable request under this Section within thirty (30) days.

6.2 Audits

Customer, or an independent auditor appointed by Customer and reasonably acceptable to rConfig, may audit rConfig's compliance with this DPA:

• not more than once in any twelve (12) month period, save where required by a supervisory authority or following a Personal Data Breach affecting Customer;
• on not less than thirty (30) days' written notice;
• during business hours, in a manner that minimises disruption;
• subject to the auditor being bound by confidentiality obligations no less protective than those in the Agreement; and
• at Customer's cost, save where the audit identifies a material breach of this DPA by rConfig, in which case rConfig will bear its own reasonable costs of remediation.

The auditor must not be a competitor of rConfig, and rConfig may withhold access to information relating to other customers, to its own commercially sensitive information, or where disclosure would breach a legal or contractual obligation.

Where Customer's requirement can reasonably be satisfied by the information provided under Section 6.1, rConfig may provide that information in place of an on-site audit.

6.3 Supervisory Authority

rConfig will cooperate with, and submit to audits and inspections by, a competent supervisory authority to the extent required by Data Protection Law, and will notify Customer of any such audit or inspection concerning processing under this DPA unless prohibited from doing so.

---

7. Support and Professional Services Access

This Section describes the controls applying to the principal processing activity under this DPA.

7.1 Access Is Customer-Granted and Purpose-Limited

rConfig has no standing access to Customer's environment. Access arises only where Customer grants it for a specific purpose, and rConfig will use it only for that purpose.

Access takes one of the following forms, and Customer determines which:

• Customer submits diagnostic material, including logs, configuration extracts, database exports, packet captures, screenshots, or a support bundle;
• Customer grants rConfig temporary interactive access, whether by screen share, supervised remote session, or time-limited credentials; or
• rConfig accesses a Customer environment pursuant to a signed statement of work.

7.2 Controls

In respect of each access, rConfig will:

• obtain Customer's approval before accessing a Customer environment, and record that approval against the relevant support request or statement of work;
• use only named personnel authorised under Section 5.3, and, on Customer's request, identify them;
• apply the least privilege necessary, and not request or use administrative credentials where read access suffices;
• log the access, including the personnel involved, the time, the purpose, and the systems reached, and make that log available to Customer on request;
• not copy, extract, or transfer Personal Data out of Customer's environment beyond what is necessary for diagnosis, and not to any location outside those identified in Annex I;
• store diagnostic material only in the systems identified in Annex III, under the measures in Annex II; and
• delete diagnostic material in accordance with Section 5.8.

7.3 Customer Controls

Customer is responsible for:

• determining what diagnostic material it submits, and for redacting, masking, or excluding Personal Data, credentials, and secrets that rConfig does not require;
• scoping, monitoring, and revoking any access it grants, promptly on completion;
• ensuring it has a lawful basis, and where it is a processor the controller's authority, for disclosing the material or granting the access; and
• not submitting special categories of Personal Data.

Where Customer submits material containing more Personal Data than rConfig requires, rConfig may return or delete it and ask Customer to resubmit a reduced set.

7.4 Vector Agent Credentials

Where Customer operates the Vector Agent, credentials are cached locally on hosts within Customer's or an End Client's network under the Vector Agent Product Schedule. rConfig neither holds, escrows, accesses, nor receives those cached credentials, and they are outside the scope of this DPA except where they appear in diagnostic material Customer submits under Section 7.1.

---

8. Sub-Processors

8.1 General Authorisation

Customer gives rConfig general written authorisation to engage Sub-Processors, subject to this Section.

8.2 Current Sub-Processors

The Sub-Processors engaged at the date of this DPA are listed in Annex III, together with their location and the purpose for which each is engaged. rConfig maintains the current list at {{CONFIRM: sub-processor list URL}}.

8.3 New Sub-Processors and Right to Object

rConfig will notify Customer in writing, or by updating the list at the location in Section 8.2 where Customer has subscribed to notifications of changes to it, not less than thirty (30) days before a new Sub-Processor begins processing Personal Data under this DPA.

Customer may object on reasonable grounds relating to data protection within that thirty (30) day period. The parties will discuss the objection in good faith. Where the objection cannot be resolved, and rConfig cannot provide the affected service without the proposed Sub-Processor, Customer may terminate the affected Support subscription on written notice and receive a pro-rated refund of prepaid fees for the unexpired period, which is Customer's sole remedy.

Where Customer does not object within the notice period, the Sub-Processor is deemed authorised.

8.4 Terms and Liability

rConfig will impose on each Sub-Processor, by written contract, data protection obligations no less protective than those in this DPA, appropriate to the nature of the services that Sub-Processor provides.

rConfig remains fully liable to Customer for the performance of each Sub-Processor's obligations, and for any act or omission of a Sub-Processor, as if it were rConfig's own.

Where a Sub-Processor is located outside the EEA, the United Kingdom, or Switzerland as applicable, rConfig will ensure that an appropriate transfer mechanism under Section 9 is in place.

8.5 Emergency Replacement

Where rConfig must replace a Sub-Processor urgently for security, continuity, or legal reasons, rConfig may do so and will notify Customer as soon as reasonably practicable, and Customer's right to object under Section 8.3 then applies from the date of that notice.

---

9. International Transfers

9.1 Transfer Locations

The locations in which Personal Data is processed under this DPA are set out in Annex I, Section B, and in Annex III in respect of each Sub-Processor. rConfig will not transfer Personal Data to a location not identified there without complying with Section 8.3.

9.2 EEA Transfers

Where a Restricted Transfer of Personal Data subject to GDPR occurs, the SCCs are incorporated into this DPA by reference and apply to that transfer, as follows:

• where Customer is a controller and rConfig is a processor, Module Two applies;
• where Customer is a processor and rConfig is a sub-processor, Module Three applies;
• Clause 7, the docking clause, applies;
• in Clause 9, Option 2, general written authorisation, applies, with the notice period stated in Section 8.3;
• in Clause 11, the optional independent dispute resolution wording does not apply;
• in Clause 17, the governing law is the law of Ireland;
• in Clause 18(b), the forum is the courts of Ireland;
• Annex I to the SCCs is Annex I to this DPA;
• Annex II to the SCCs is Annex II to this DPA; and
• Annex III to the SCCs, where required, is Annex III to this DPA.

By agreeing to this DPA the parties are deemed to have signed the SCCs at the date of this DPA.

9.3 United Kingdom Transfers

Where a Restricted Transfer of Personal Data subject to UK Data Protection Law occurs, the UK Addendum is incorporated into this DPA by reference and applies to that transfer, with the SCCs as amended by it. For the purposes of Table 4 of the UK Addendum, neither party may end the UK Addendum as set out in Section 19 of it.

9.4 Swiss Transfers

Where a Restricted Transfer of Personal Data subject to Swiss data protection law occurs, the SCCs apply with references to GDPR read as references to the Swiss Federal Act on Data Protection, references to the competent supervisory authority read as including the Swiss Federal Data Protection and Information Commissioner, and the term "member state" read so as not to deprive a data subject in Switzerland of the ability to bring proceedings in Switzerland.

9.5 Transfer Impact Assessments

rConfig will provide Customer, on reasonable request, with the information reasonably necessary for Customer to carry out a transfer impact assessment, including information about the legal regime applicable to each Sub-Processor and about any request for disclosure rConfig has received.

9.6 Government and Law Enforcement Access

Where rConfig receives a legally binding request from a public authority for disclosure of Personal Data processed under this DPA, rConfig will:

• notify Customer without undue delay, unless prohibited by law, in which case rConfig will use reasonable efforts to obtain a waiver of that prohibition and will document its efforts;
• challenge the request where it has reasonable grounds to consider it unlawful under applicable law, including by seeking interim measures, and will not disclose Personal Data until required to do so under the applicable procedure; and
• disclose only the minimum amount of Personal Data required, based on a reasonable interpretation of the request.

rConfig warrants that it has not, at the date of this DPA, created any back door or similar programming that could be used to access its systems or Personal Data, and that it has not received any request to do so.

---

10. Personal Data Breach

10.1 Notification

rConfig will notify Customer of a Personal Data Breach without undue delay, and in any event within forty-eight (48) hours, after becoming aware of it.

10.2 Content of Notification

The notification will include, to the extent known and available at the time, and will be supplemented as further information becomes available:

• a description of the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address the breach and to mitigate its adverse effects; and
• the name and contact details of rConfig's contact point.

Notification of a Personal Data Breach is not, and must not be construed as, an acknowledgement by rConfig of fault or liability.

10.3 Cooperation

rConfig will take reasonable steps to contain, investigate, and mitigate the Personal Data Breach, and will cooperate with Customer and provide reasonable assistance in respect of Customer's obligations under Articles 33 and 34.

rConfig will not notify any supervisory authority or data subject in respect of a Personal Data Breach affecting Personal Data processed under this DPA except where required by law, and will not name Customer in any public statement without Customer's prior written consent unless required by law.

---

11. Processing Outside the Scope of This DPA

11.1 Telemetry

Where the platform transmits telemetry or diagnostic data to rConfig, as described in the Agreement, rConfig processes that data as a controller for the purposes of product improvement, security, licence compliance, and support, on the legal bases set out in the Privacy Policy.

Telemetry does not include device configuration content, credentials, or network traffic. It is not processed on Customer's behalf and is outside the scope of this DPA. Where telemetry can be disabled, the Agreement and the Documentation identify the mechanism.

11.2 Model Providers

Where Customer configures an AI Feature to submit data to a Model Provider, Customer determines what data is submitted and the Model Provider is Customer's own third party.

Such submission is not processing by rConfig, rConfig is not a controller, processor, or sub-processor in respect of it, and it is outside the scope of this DPA. Customer is responsible for its own lawful basis, notices, transfer mechanism, and contractual arrangements with the Model Provider.

11.3 Customer's Operational Environment

Personal Data held within Customer's environment to which rConfig has no access is not processed by rConfig, and Customer's processing of it is not governed by this DPA.

---

12. Multi-Tier and MSP Arrangements

12.1 Where Customer Acts as a Processor

Where Customer uses the platform to provide services to End Clients and acts as those End Clients' processor, rConfig acts as a sub-processor and Module Three of the SCCs applies to any Restricted Transfer.

Customer warrants that:

• it has the authority of each relevant controller to appoint rConfig as a sub-processor on the terms of this DPA;
• its contract with each End Client permits rConfig's engagement, the categories of processing described in Annex I, and the engagement of the Sub-Processors listed in Annex III; and
• it will pass on to the relevant controller any notification, information, or assistance rConfig provides under this DPA where that controller is entitled to it.

12.2 No Direct Relationship with End Clients

rConfig has no contractual relationship with, and owes no duty under this DPA to, any End Client. rConfig will not accept instructions from, correspond with, or provide information directly to any End Client, and will route all matters through Customer.

Customer is solely responsible for responding to its End Clients, for handling their data subject requests, and for notifying them of any Personal Data Breach affecting their data.

12.3 Customer's Own Obligations

Customer is the controller, or the processor of its End Clients, in respect of all Personal Data processed in Vector Prism, including portal user account data, authentication data, access logs, and audit records. rConfig has no access to any Prism instance except where Customer grants it under Section 7.

---

13. Liability

13.1 Cap

Each party's liability arising out of or in connection with this DPA is subject to, and counts towards, the aggregate limitation of liability in the Agreement.

13.2 Exclusions from the Cap

Nothing in this DPA or the Agreement limits or excludes:

• either party's liability to a data subject under Article 82 GDPR;
• either party's liability for an administrative fine imposed on it by a supervisory authority;
• liability for death or personal injury caused by negligence;
• liability for fraud or fraudulent misrepresentation; or
• any other liability that cannot lawfully be limited or excluded.

13.3 Apportionment

Where both parties are found liable for the same damage under Article 82, each party's share as between them is to be determined by reference to its respective responsibility for the damage, and each party will reimburse the other to that extent.

---

14. Term and Termination

This DPA takes effect on the earlier of the effective date of the Agreement and the date rConfig first processes Personal Data on Customer's behalf, and continues for so long as rConfig processes Personal Data under the Agreement.

Sections 5.3, 5.8, 6, 9, 10, 13, and this Section survive termination of this DPA and of the Agreement for so long as rConfig holds any Personal Data processed under it.

Termination of this DPA does not of itself terminate the Agreement. Termination of the Agreement terminates this DPA subject to the survival provisions above.

---

15. General

15.1 Amendment

rConfig may amend this DPA where required to reflect a change in Data Protection Law, a decision of a competent authority, a new or replacement transfer mechanism, or a change in Sub-Processors notified under Section 8.3, provided that the amendment does not materially reduce the protections afforded to Customer. rConfig will publish the amended version and notify Customer of any material change not less than thirty (30) days before it takes effect.

Any other amendment requires a written document signed by an authorised representative of each party.

15.2 Notices

Notices under this DPA must be given in accordance with the notices provision of the Agreement, and notices to rConfig concerning data protection must additionally be copied to the contact point in Section 5.9.

15.3 Severability

If any provision of this DPA is held invalid, illegal, or unenforceable, it will be modified to the minimum extent necessary to make it enforceable or, if that is not possible, severed, and the remaining provisions continue in full force. Where a provision of the SCCs is affected, the parties will negotiate in good faith an alternative mechanism that provides an equivalent level of protection.

15.4 No Third-Party Rights

Save in respect of rights conferred on a data subject by Data Protection Law or by the SCCs, this DPA confers no right on any third party.

15.5 Governing Law and Jurisdiction

This DPA is governed by the law of Ireland and the parties submit to the exclusive jurisdiction of the courts of Ireland, save where the SCCs, the UK Addendum, or Data Protection Law require otherwise.

---

Execution

Where the parties elect to execute this DPA as a signed document:

For and on behalf of OS Informatics Limited T/A rConfig

Name: ________________________ Title: ________________________

Signature: ____________________ Date: ________________________

For and on behalf of the Customer

Legal entity name: ______________________________________________

Registered address: _____________________________________________

Company or registration number: __________________________________

Data protection contact and email: ________________________________

Name: ________________________ Title: ________________________

Signature: ____________________ Date: ________________________

---

---

Annex I, Details of Processing

This Annex is Annex I to the SCCs where those clauses apply.

A. List of Parties

Data exporter. The Customer identified in the Agreement and in the execution block above. Role: controller, or processor where Section 3.1 applies. Contact: as stated in the execution block. Activities relevant to the transfer: receipt of Support and Professional Services in respect of the rConfig platform deployed in the Customer's own infrastructure.

Data importer. OS Informatics Limited T/A rConfig, 44 Longshore Drive, Jacobs Island, Cork, Ireland. Role: processor, or sub-processor where Section 3.1 applies. Contact: J.W. O'Donovan LLP, 27 South Mall, Cork T12 R2RV, Ireland. Activities relevant to the transfer: provision of Support and Professional Services.

B. Description of Processing

C. Competent Supervisory Authority

Where the SCCs apply and Customer is established in the EEA, the competent supervisory authority is that of Customer's place of establishment. Where Customer is not established in the EEA but the processing falls within Article 3(2) GDPR, and Customer has appointed a representative, the competent supervisory authority is that of the member state in which the representative is established. Where Customer has not appointed a representative, the competent supervisory authority is that of the member state in which the data subjects are located.

rConfig's own lead supervisory authority is the Data Protection Commission of Ireland.

---

---

Annex II, Technical and Organisational Measures

This Annex is Annex II to the SCCs where those clauses apply.

1. Access Control and Authentication

• Role-based access control applied to all systems processing Personal Data, on a least-privilege basis.
• Multi-factor authentication required for all administrative and remote access.
• Unique named accounts. No shared or generic credentials for access to Personal Data.
• Credentials stored in a managed secrets system. Access reviewed at least every six months and revoked promptly on role change or departure.
• Session timeouts and account lockout on repeated failed authentication.

2. Encryption

• Personal Data encrypted in transit using TLS 1.2 or higher with modern cipher suites.
• Personal Data at rest encrypted at the volume or database level in rConfig's support, ticketing, and licensing systems.
• Backups encrypted at rest, with keys managed separately from the data.
• Diagnostic material transferred only by encrypted channels. Transfer by unencrypted email is not permitted.

3. Logging and Monitoring

• Access to systems holding Personal Data is logged, including identity, time, and action.
• Support access to a Customer environment is logged against the relevant support request, per Section 7.2.
• Logs retained for a period appropriate to investigation needs and protected against alteration.
• Alerting on anomalous authentication and privilege escalation.

4. Personnel

• Personnel bound by written confidentiality obligations surviving termination of employment or engagement.
• Data protection and security awareness training on induction and periodically thereafter.
• Background checks to the extent permitted by law for personnel with access to Personal Data.
• Documented process for prompt revocation of all access on departure.

5. Secure Development and Change Management

• Version control, peer review, and documented change management for all production changes.
• Dependency and vulnerability scanning, with remediation prioritised by severity.
• Separation of development, staging, and production environments. Personal Data is not used in development or test environments.
• Documented vulnerability management and coordinated disclosure process.

6. Resilience and Continuity

• Regular backups of systems holding Personal Data, with periodic restore testing.
• Documented business continuity and disaster recovery arrangements.
• Redundancy appropriate to the criticality of each system.

7. Incident Management

• Documented Personal Data Breach identification, escalation, containment, investigation, and notification process, aligned to Section 10.
• Named internal owner for incident response.
• Post-incident review with corrective actions tracked to closure.

8. Physical and Environmental Security

• Systems hosted in facilities with physical access controls, environmental controls, and continuous monitoring. Facility details as set out in Annex III.
• End-user devices encrypted, centrally managed, and capable of remote wipe.
• Secure disposal of media and devices.

9. Data Minimisation and Deletion

• Diagnostic material requested and retained only to the extent necessary, per Section 7.2.
• Documented retention and deletion schedule aligned to Section 5.8.
• Secure deletion procedures, including for backups on expiry of the applicable cycle.

10. Sub-Processor Management

• Data protection due diligence before engagement.
• Written contracts imposing obligations no less protective than this DPA.
• Periodic review of Sub-Processor compliance.
• Maintained Sub-Processor list, per Section 8.2.

---

---

Annex III, Sub-Processors

This Annex is Annex III to the SCCs where those clauses apply.

| Sub-Processor | Purpose | Location of processing | Transfer mechanism where applicable | |---|---| | Freshdesk | Support ticket management and correspondence | | Hetzner | Hosting of rConfig support and licensing systems | | Microsoft Exchange Online | Transactional and notification email | | Xero | Invoicing and credit control | | Zoom or Teams | Supervised remote support sessions |

---

END OF DATA PROCESSING ADDENDUM