Data Processing Agreement

Last updated: July 9, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written agreement between TerminalStreet LLC. ("Processor" or "TerminalStreet") and the customer ("Controller") for the purchase of services from TerminalStreet ("Services") that involve the processing of personal data.

1. Definitions

For the purposes of this DPA, the following terms shall have the following meanings:

• "Applicable Data Protection Law" means all laws and regulations applicable to the processing of personal data under the Agreement, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"), and any other data protection or privacy laws that apply to the processing activities under this DPA.
• "Controller" means the entity which determines the purposes and means of the processing of personal data.
• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable person is one who can be identified, directly or indirectly.
• "Processor" means the entity which processes personal data on behalf of the Controller.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Subprocessor" means any processor engaged by TerminalStreet to process personal data on behalf of the Controller.
• "Security Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

2. Processing of Personal Data

2.1 Roles of the Parties

The parties acknowledge and agree that with regard to the processing of personal data, the Customer is the Controller and TerminalStreet is the Processor. TerminalStreet will process personal data only as a processor acting on behalf of the Controller.

2.2 Controller's Processing Instructions

TerminalStreet shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by Union or Member State law to which TerminalStreet is subject; in such a case, TerminalStreet shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2.3 Details of the Processing

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the Controller, are specified in Annex A to this DPA.

3. TerminalStreet's Obligations

3.1 Confidentiality

TerminalStreet shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.2 Security Measures

TerminalStreet shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, among others:

• The pseudonymization and encryption of personal data where appropriate;
• The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
• The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
• A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

3.3 Subprocessors

TerminalStreet shall not engage another processor without prior specific or general written authorization of the Controller. In the case of general written authorization, TerminalStreet shall inform the Controller of any intended changes concerning the addition or replacement of other processors, thereby giving the Controller the opportunity to object to such changes.

Where TerminalStreet engages another processor for carrying out specific processing activities on behalf of the Controller, the same data protection obligations as set out in this DPA shall be imposed on that other processor by way of a contract, providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of Applicable Data Protection Law.

3.4 Assistance to Controller

TerminalStreet shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to TerminalStreet.

TerminalStreet shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights under Applicable Data Protection Law.

3.5 Security Breach Notification

TerminalStreet shall notify the Controller without undue delay after becoming aware of a Security Breach and shall provide information relating to the Security Breach as reasonably requested by the Controller.

3.6 Data Protection Impact Assessment

Upon Controller's request, TerminalStreet shall provide the Controller with reasonable assistance with any data protection impact assessments and prior consultations with supervisory authorities that the Controller is required to carry out under Applicable Data Protection Law.

3.7 Deletion or Return of Personal Data

Upon termination of the Services, TerminalStreet shall, at the choice of the Controller, delete or return all personal data to the Controller and delete existing copies unless Union or Member State law requires storage of the personal data.

3.8 Information and Audit Rights

TerminalStreet shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

4. Controller's Obligations

4.1 Lawful Instructions

The Controller shall ensure that its instructions for the processing of personal data comply with Applicable Data Protection Law. The Controller is responsible for the accuracy, quality, and legality of personal data and the means by which it acquired the personal data.

4.2 Technical and Organizational Measures

The Controller is responsible for implementing appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with Applicable Data Protection Law.

5. Liability

Each party shall be liable to the other party for damages it causes by any breach of this DPA. Liability as between the parties shall be limited to actual damage incurred. Neither party shall be liable to the other party for any indirect, special, consequential damages or loss of profits.

6. General Terms

6.1 Governing Law

This DPA shall be governed by the laws of the State of Wyoming, without regard to its conflict of law principles.

6.2 Term

This DPA shall remain in effect for as long as TerminalStreet processes personal data on behalf of the Controller under the Agreement.

6.3 Precedence

In the event of any conflict or inconsistency between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail with respect to the subject matter hereof.

ANNEX A: Details of Processing

Categories of Data Subjects

The personal data transferred concern the following categories of data subjects:

• Controller's end users, customers, and prospective customers
• Controller's employees, contractors, and agents authorized to use the Services
• Other individuals whose personal data is processed through the Services

Categories of Personal Data

The personal data transferred may include the following categories of data:

• Identification data: name, username, password, email address, phone number, IP address
• Professional data: job title, employer, professional qualifications
• Commercial data: records of products or services purchased, obtained, or considered
• Technical data: device information, system logs, usage data
• Communications data: contents of communications sent through or stored on the Services
• Any other personal data that the Controller or its users choose to include in the content processed through the Services

Processing Activities

The personal data will be subject to the following basic processing activities:

• Storage, backup, and processing necessary to provide the Services
• Technical support and maintenance
• Bug fixing and troubleshooting
• Account management and billing
• Service improvement and optimization
• Security monitoring and incident response
• Any other processing activities necessary to provide the Services as described in the Agreement

Duration of Processing

TerminalStreet will process personal data for the duration of the Agreement, unless otherwise agreed upon in writing.