Data Processing Addendum

1. Parties and scope

This Data Processing Addendum (“DPA”) forms part of the Agreement between the customer identified in an Order Form (“Customer”) and Evigur Solutions, operating 365 Help center (“Processor”). It applies when Processor processes Personal Data on Customer’s behalf to provide subscription support. Customer is the controller or business; 365 Help center is the processor or service provider, as those terms are defined by applicable Data Protection Law.

2. Definitions

“Personal Data,” “process,” “controller,” “processor,” “data subject,” “personal information,” “business” and “service provider” have the meanings given by applicable Data Protection Law. “Security Incident” means confirmed unauthorized access to, acquisition of, or disclosure of Customer Personal Data in Processor’s possession or control, excluding unsuccessful attempts that do not compromise data.

3. Customer instructions

Processor will process Customer Personal Data only to provide the contracted services, follow documented lawful instructions, protect the services, prevent fraud, and comply with law. The Agreement, tickets and authorized directions are Customer’s documented instructions. Processor will notify Customer if an instruction appears unlawful unless prohibited.

4. Customer responsibilities

Customer determines the lawfulness, purpose and means of processing; provides required notices; obtains necessary consents; limits access and data to what is necessary; and avoids submitting restricted data unless expressly approved. Customer will not place payment-card data, health data, government identifiers, credentials or other highly sensitive data in tickets unless a signed agreement specifically authorizes it.

5. Confidentiality and personnel

Processor will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive appropriate security awareness, and access data only as necessary for assigned support work.

6. Security measures

Processor will maintain reasonable administrative, technical and organizational safeguards appropriate to the risk, including the controls described in Schedule 2. Controls address identity and access management, multifactor authentication, least privilege, endpoint protection, encryption, logging, vulnerability management, incident response, continuity, personnel practices and secure disposal.

7. Subprocessors

Customer authorizes the subprocessors identified in the applicable Order Form, security schedule, or current subprocessor list provided during contracting or on request. Processor will impose materially similar data-protection obligations on subprocessors and remain responsible for their processing as required by law. Processor will provide advance notice of material new subprocessors and a reasonable opportunity to object on legitimate data-protection grounds.

8. Assistance

Taking into account the nature of processing, Processor will reasonably assist Customer with data-subject requests, security obligations, impact assessments and regulator consultations. Customer remains responsible for responding to requests. Material assistance beyond ordinary support may be billable if permitted by the Agreement.

9. Security incidents

Processor will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data. Notice will include available information about the nature of the incident, affected data, likely consequences, mitigation and contact information. Processor will investigate, contain and remediate within its control and provide reasonable updates. Notification is not an admission of fault.

10. Return and deletion

At termination or Customer’s written request, Processor will return or delete Customer Personal Data within 90 days, unless the Agreement specifies another period, law requires retention, or data remains in secure backups until overwritten under standard retention. Processor may retain minimal records required for legal, security and billing purposes.

11. Audits and information

Processor will provide information reasonably necessary to demonstrate compliance. No more than annually, unless following a Security Incident or regulator request, Customer may request relevant third-party reports or conduct a reasonable audit with advance notice, confidentiality protections, scope limits and no disruption. Customer bears audit costs unless material noncompliance is found.

12. International transfers

Processor will not transfer regulated Personal Data across borders except as permitted by applicable law and the Agreement. If European transfer restrictions apply, the parties will incorporate the applicable Standard Contractual Clauses and UK Addendum or another valid mechanism, with the appropriate modules and annexes completed.

13. U.S. state privacy commitments

To the extent applicable, Processor will process personal information only for the limited and specified business purposes in the Agreement; will not sell or share it for cross-context behavioral advertising; will not retain, use or disclose it outside the direct business relationship except as legally permitted; will provide the same level of privacy protection required by applicable law; and will notify Customer if it can no longer comply.

Schedule 1 — Processing details

Schedule 2 — Security controls

• MFA and separate named administrative accounts;
• Role-based and least-privilege access with periodic review;
• Encryption in transit and at rest where supported;
• Managed endpoints, malware protection and patching;
• Ticketing, audit logs and access monitoring;
• Personnel screening where lawful and confidentiality commitments;
• Incident response and escalation procedures;
• Backup and continuity controls for Processor-controlled systems;
• Secure deletion and retention standards;
• Subprocessor due diligence.

Schedule 3 — Acceptance