Data Processing Agreement

Standard terms · November 2026

ARTICLE 28 GDPR · FOR AGREEMENT Q-2026-[XXXX]

The Client · Controller

[Client legal name]
[Registered address, city, country]
[Register court · number]

EcoComply · Processor

EcoComply GmbH
Bildungscampus 11, 74076 Heilbronn, Germany
Amtsgericht Stuttgart · HRB 802310

[Client legal name] (the “Client”) and EcoComply GmbH (“EcoComply”) conclude this data processing agreement (“DPA”) in accordance with Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) for their Quotation & Service Agreement Q-2026-[XXXX] (the “Agreement”).

01 Scope

EcoComply processes personal data on the Clientʼs behalf to perform the Agreement: registrations, filings and reports in the Clientʼs name, scheme contracts under the Clientʼs power of attorney, and the Clientʼs space on the EcoComply platform. For this processing the Client is controller and EcoComply is processor. Where EcoComply acts in its own name as appointed representative, or processes data for its own administration, it is controller and this DPA does not apply.

02 Data

Names, job titles, business contact details, signatures and platform login data of the Clientʼs staff, signatories and business contacts, and personal data in documents and messages the Client provides. No special categories of data (Article 9 GDPR) are processed. Processing lasts for the term of the Agreement and until deletion under clause 9. The Client is responsible for the lawfulness of its data and instructions.

03 Instructions

EcoComply processes the data only on the Clientʼs documented instructions, including for transfers outside the EEA, unless EU or Member State law requires otherwise; in that case it informs the Client beforehand where the law allows. The Agreement and this DPA are the instructions; further instructions are given in text form. EcoComply informs the Client immediately if it considers an instruction unlawful.

04 Confidentiality and security

Everyone EcoComply authorises to process the data is bound to confidentiality. EcoComply takes the technical and organisational measures required by Article 32 GDPR, in particular:

• the Clientʼs space on the platform is hosted in the EU, in ISO/IEC 27001-certified data centres;
• data is encrypted in transit and at rest;
• access is by personal account and role, and limited to the people who need it;
• the platform records requests, messages and uploads with user and time;
• AI providers may not use the data to train their models.

05 Sub-processors

The Client approves the sub-processors listed in this DPA and authorises EcoComply in general to engage others. EcoComply announces any new sub-processor in text form at least 14 days in advance, and the Client may object on reasonable data protection grounds. If no solution is found, either party may end the affected services. EcoComply binds each sub-processor to the same data protection obligations in substance and remains liable for it as for its own performance. Sub-processors process data outside the EEA only on the basis of an adequacy decision or Standard Contractual Clauses (Articles 45 and 46 GDPR). Registers, authorities, schemes and local representatives acting in their own name are not sub-processors.

06 Assistance

EcoComply forwards data subjectsʼ requests to the Client without undue delay and helps the Client, as far as possible, to answer them and to meet its duties under Articles 32 to 36 GDPR.

07 Data breaches

EcoComply notifies the Client of any breach of the Clientʼs personal data without undue delay, at the latest 48 hours after becoming aware of it, with the available information under Article 33(3) GDPR.

08 Evidence and audits

On request EcoComply provides the information needed to demonstrate compliance with this DPA. It allows and supports audits, including inspections, by the Client or an auditor mandated by it and bound to confidentiality: once a year on 30 daysʼ notice during business hours, and also where a data breach or an authority gives cause. Each party bears its own costs.

09 End of processing

When the Agreement ends, EcoComply returns the data if the Client asks within 30 days, and deletes it, including copies, within 90 days, unless EU or Member State law requires storage or EcoComply holds the data as controller. On request EcoComply confirms the deletion.

10 Liability and general

The liability terms of the Agreement apply to this DPA, and the cap agreed there applies once to both together; claims of data subjects under Article 82 GDPR are not affected. On data protection this DPA prevails over the Agreement; otherwise the Agreement applies, including governing law and place of jurisdiction. Changes need text form. Notices go to the Clientʼs contact named in the Agreement and to privacy@ecocomply.ai. This DPA takes effect on the last signature and may be signed electronically.

Sub-processors approved under clause 5

Google Cloud EMEA Limited

Ireland, and affiliates

Service: Platform hosting and storage, AI-assisted analysis, sign-in and bot protection, usage analytics (with consent), email and office software
Place of processing: EU. Sign-in, bot protection, analytics, network routing, email and office software may also involve the USA.

Softalgo Solutions SRL

Romania

Service: Development and technical operation of the platform
Place of processing: Romania

MailerSend, Inc.

USA

Service: Platform notification emails
Place of processing: Belgium; may also be processed in the USA

Datadog, Inc.

USA

Service: Platform monitoring and session replay with input masking (with consent)
Place of processing: Germany

Slack Technologies Limited

Ireland

Service: Internal team communication
Place of processing: USA

Anthropic Ireland, Limited

Ireland

Service: Claude, the AI assistant the EcoComply team uses to prepare documents
Place of processing: USA; requests may also be routed to Europe, Asia and Australia

Claude runs under Anthropicʼs Commercial Terms: the data is not used to train models, and Anthropicʼs data processing addendum with Standard Contractual Clauses applies.

For the Client

[Client legal name]
Authorised signatory

Name: ____________________
Title: ____________________
Signature: ____________________
Place, date: ____________________

For EcoComply GmbH

John Iwueke
CEO & Managing Director

Signature: ____________________
Place, date: Heilbronn, ____________________