Data Processing Agreement

Terms used here have the meaning given to them in the EU General Data Protection Regulation (GDPR). In this DPA, the Customer acts as the Controller and Evenpay as the Processor; references to the Supplier mean Evenpay.

In this appendix the Parties agree on the conditions under which the Processor processes personal data on behalf of the Controller during the term of this Agreement.

The Controller acts as a controller with respect to the personal data processed under this Agreement and is responsible for fulfilling all obligations required of a controller by mandatory law.

The Processor processes personal data to provide and deliver the products and services specified in the commercial service agreement (of which this is an appendix) and in accordance with any specific instructions given by the Controller.

The Processor must notify the Controller if it considers that the Controller’s written instructions regarding processing infringe the GDPR or other applicable mandatory data-protection provisions. In addition to the terms of this Agreement, each Party undertakes to comply with applicable national data-protection laws and the provisions of the GDPR as applicable to its activities.

The Processor processes personal data until the commercial service agreement between the Parties ends, unless the Controller otherwise directs, or until the data is returned or destroyed in accordance with the Controller’s instructions.

The Processor’s processing of personal data on behalf of the Controller includes, among other things, receiving, collecting, recording, storing, retaining, modifying, using, disclosing by transfer, deleting or destroying and other operations performed on personal data.

a) Groups of data subjects

Personal data may concern several groups of data subjects, such as users of the services under the commercial agreement between the Parties or employees of the Controller.

b) Categories of personal data

The personal data processed may concern several categories of personal data, such as name, address, telephone number, email address, employee ID, salary information and other data. The types of personal data processed are defined in Appendix A.

The Processor stores and processes personal data only in the EU: personal data is stored and the application is processed in Google Cloud europe-north1 (Finland), and AI inference runs on Google Cloud Vertex AI in europe-west4 (the Netherlands).

Some sub-processors’ parent companies may be established outside the EU/EEA; all sub-processors process the Controller’s personal data within the EU. All locations and sub-processors are listed in Appendix B of this DPA.

If personal data is transferred to countries outside the EU or EEA, such transfer, subject to the Controller’s separate prior written consent, must take place using (i) the European Union’s standard contractual clauses for transfers of personal data or equivalent clauses approved by the European Union that replace them, or (ii) other appropriate transfer mechanisms as defined in the GDPR, using and following the instructions given by the Controller.

The Processor may use sub-processors to process personal data. The Processor is responsible for the actions of its sub-processors as for its own actions and will conclude written agreements on personal-data processing with its sub-processors. The current sub-processors are listed in Appendix B. An updated list of sub-processors is available on the Processor’s website. The Processor will inform the Controller of any intended addition or replacement of a sub-processor at least thirty (30) days in advance. The Controller may object to the change on reasonable data-protection grounds within that period, in which case the Parties will negotiate in good faith to find a solution.

The Processor must ensure that it implements appropriate technical and organisational measures to prevent the accidental, unauthorised and/or unlawful destruction, loss, alteration, unauthorised disclosure or transfer or access to personal data processed on behalf of the Controller. For the avoidance of doubt, the Processor is not responsible for the technical security of information systems or services that are the property of the Controller or where the intellectual-property rights belong to the Controller or a third party, unless otherwise expressly agreed. If the Processor is to assist the Controller in improving, developing or maintaining the technical or organisational security of such systems or services, the Parties will agree separately on such work, its costs and other terms.

Security measures must be planned taking into account the latest technology and implementation costs, the nature, scope, context and purposes of processing and the risks of varying likelihood and severity to the rights and freedoms of natural persons, such as:

1. Pseudonymisation and encryption of personal data;
2. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. The ability to restore the availability of and access to data quickly in the event of a physical or technical incident; and
4. A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

Taking into account the state of the art, implementation costs and the nature, scope, context and purpose of processing and the risks to the rights and freedoms of natural persons, Evenpay always implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include at least those defined in Article 32(1) of the GDPR and the security measures in place on the effective date of the Agreement and are maintained at least at the same level throughout the contract period. Evenpay operates an information security management system certified to ISO/IEC 27001:2022 since 26 February 2026. Personal data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256; sensitive personal data is additionally encrypted at the application layer with AES-256-GCM using organisation-specific keys managed in Google Cloud KMS within the EU and rotated at least annually. Public endpoints are protected by Google Cloud Armor (web application firewall, DDoS mitigation and rate limiting).

The Customer has the right, with reasonable prior notice and at its own cost, to audit, itself or through an independent third-party auditor, Evenpay’s processing of personal data under this DPA (“Audit”). The purpose of the audit is to ensure compliance by Evenpay with data-protection obligations and processing activities. Evenpay will remedy, at its own cost, any deficiencies identified in its compliance with this DPA.

Evenpay will assist in performing the audit to a reasonable extent, provided that:

• The audit is conducted in a manner that does not unreasonably disrupt Evenpay’s business and may be performed at most once (1) per calendar year, unless an additional audit is required by a competent supervisory authority or follows a personal-data breach affecting the Controller’s personal data;
• The Customer notifies Evenpay of the audit in writing at least thirty (30) days before it is performed;
• The Customer is responsible for all costs of conducting the audit and compensates Evenpay for all reasonable costs incurred by Evenpay in enabling the audit, including arranging access to Evenpay’s or its sub-processors’ processing facilities or information systems;
• Evenpay has the right to demonstrate compliance primarily by providing the Customer with information-security or audit reports prepared by an independent third party (for example, its ISO/IEC 27001:2022 certificate and Statement of Applicability, penetration test summaries or similar reports). An on-site audit may be conducted only if such reports are insufficient to demonstrate compliance with this DPA;
• The audit may also be directed at the activities of Evenpay’s sub-processors insofar as they permit it under their own terms. The sub-processor may alternatively provide the Customer with an assurance report to fulfil the audit obligation;
• Persons performing the audit must not be competitors of Evenpay and must undertake in writing to comply with Evenpay’s security and confidentiality requirements before the audit begins.
• The audit right also applies after the end of the Agreement for three (3) years insofar as the audit concerns processing activities or security obligations during the contract period.

Taking into account the nature of the processing, the Processor must reasonably and without undue delay assist the Controller with appropriate technical and organisational measures, where possible, in fulfilling the Controller’s obligation to respond to requests concerning the exercise of the data-subject rights provided for in the GDPR. Such rights include, as defined in the GDPR:

1. The right of access to personal data;
2. The right to rectify incorrect data;
3. The right to erasure of data (“right to be forgotten”);
4. The right to restrict processing;
5. The right to data portability, i.e. the right to have data transferred from one system to another;
6. The right to object to processing;
7. The right not to be subject to automated decision-making, including profiling; and
8. The right to withdraw consent.

If such requests are made directly to the Processor, it must immediately notify the Controller. The Controller can request the Processor’s assistance at [email protected].

The Processor must notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware, of any personal-data breach that comes to its attention during processing so that the Controller can fulfil the notification obligations specified in the GDPR within the prescribed time limit. The notice must provide sufficient information, which may be provided in phases where not all information is available at once, and the Processor must otherwise assist the Controller so that the Controller can fulfil its obligations under the GDPR. The Processor must also take the necessary follow-up measures to mitigate the adverse effects of the personal-data breach or to prevent future breaches.

This agreement enters into force when both Parties have signed it and remains in force until the commercial agreement between the Parties ends. Each Party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the commercial agreement.

Within thirty (30) days after the Agreement ends, the Processor shall, at the Controller’s choice, either delete or return all personal data to the Controller and delete existing copies, and remove its user accounts in the Controller’s information systems, unless applicable law requires the personal data to be retained. Personal data contained in encrypted backups is deleted on a rolling basis (daily backups are retained for 30 days, weekly backups for 90 days and monthly backups for 12 months), so that all backup copies are permanently purged within twelve (12) months of termination.

If the Controller has not informed of deletion or return of the data within thirty (30) days of the termination of the Agreement, the Processor shall delete the personal data and copies thereof, unless applicable law requires the personal data to be retained. In that case the Processor has the right to retain personal data in accordance with the requirements of the law, without otherwise continuing the processing of personal data, and while still complying with the confidentiality obligations described in this appendix.

• Customer’s/Partner’s employees;
• Customer’s/Partner’s contact persons.

• Name;
• Telephone number;
• Email address;
• Place of residence;
• Login information;
• Employee ID;
• National identification number, only if the Controller includes it in an import file or HR-system feed and gender or date of birth is not otherwise provided: used temporarily during the import to derive gender and date of birth, then discarded and never stored;
• Date of birth and age;
• Gender;
• Education and qualifications;
• Performance evaluations;
• Employment information (such as job title, level, job family and organisational unit);
• Salary information, salary bases and changes;
• Log data;
• IP address;
• Nationality;
• Primary country of work.

To allow the Processor to process sensitive personal data on behalf of the Controller, the Controller must list in the table below the sensitive personal data processed by the Processor.

The Controller is also obliged to inform the Processor and to supplement the table below if the information changes while this appendix is in force.

The purpose of the Processor’s processing of personal data on behalf of the Controller is to provide services in accordance with the Agreement.

The Processor’s processing of personal data on behalf of the Controller mainly relates to receiving, storing, recording, analysing, reporting, sending, anonymising and deleting data, including AI-assisted features on Google Cloud Vertex AI, which receive only pseudonymised or aggregated data and are not used to train AI models.

The Processor processes personal data on behalf of the Controller for as long as the Agreement is valid and applicable to the processing of Personal Data.

The following sub-processors of the Processor have access to the Controller’s personal data (2 October 2026):