Data Processing Agreement (DPA)

1. Subject Matter, Scope & Definitions

This Data Processing Agreement (“DPA”) forms an integral part of the Merchant Terms of Service (“Principal Agreement”) entered into between the Merchant (“Controller”) and Rosenwald Technologies OÜ, Registry Code 16892410, Sepapaja tn 6, 11415 Tallinn, Estonia (“Wispo” or “Processor”).

This DPA applies strictly to the extent that Wispo processes Personal Data as a Data Processor on behalf of the Merchant in the course of providing Merchant Dashboard analytics, Sub-account user management, webhook delivery, and Customer Portal administration tools. Where Wispo processes Personal Data as an independent Data Controller or Joint Controller to fulfill its statutory obligations as Merchant of Record (such as tax compliance, invoicing, fraud screening, and KYC/CDD), such processing is governed by our Privacy Notice.

Terms such as “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, and “Supervisory Authority” shall have the meanings given to them in Regulation (EU) 2016/679 (“GDPR”).

2. Obligations of the Controller & Processor

2.1 Obligations of the Merchant (Controller):

The Controller warrants that it has established a valid legal basis under GDPR Article 6 for the collection and disclosure of Personal Data to the Processor, has provided required transparency notices to Data Subjects, and that its instructions to the Processor comply with applicable EU and Member State data protection laws.

2.2 Obligations of Wispo (Processor):

• Processing on Documented Instructions: The Processor shall process Personal Data only on documented instructions from the Controller (including as set forth in the Principal Agreement, this DPA, and configurations initiated by the Merchant via the Dashboard or API), unless required to do so by European Union or Estonian law.
• Confidentiality of Personnel: The Processor ensures that all personnel and contractors authorized to process Personal Data have committed themselves to strict statutory or contractual confidentiality obligations.
• Security of Processing (GDPR Art. 32): Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, the Processor implements and maintains the technical and organisational security measures set out in Annex 2.
• Data Subject Requests (5-Business-Day Notification): If the Processor receives a request directly from a Data Subject exercising rights under GDPR Chapter III regarding Personal Data for which the Merchant is the Controller, the Processor shall forward the request to the Controller within five (5) business days and provide reasonable technical assistance to enable the Controller to respond.
• Personal Data Breach Notification (Within 24 Hours): In the event of a confirmed Personal Data Breach affecting Personal Data processed on behalf of the Controller, the Processor shall notify the Controller without undue delay and in any event within twenty-four (24) hours after becoming aware of the breach, providing relevant details of the nature of the breach, categories of data affected, and remediation measures taken.
• Assistance with DPIAs & Prior Consultation: The Processor shall provide reasonable assistance to the Controller with Data Protection Impact Assessments (GDPR Art. 35) and prior consultations with Supervisory Authorities (GDPR Art. 36) where required.

3. Compliance Documentation & Audit Rights

• Provision of Compliance Information (15 Business Days): Upon the Controller's written request, the Processor shall make available within fifteen (15) business days all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and GDPR Article 28.
• Audit Procedure (30 Calendar Days' Notice): Where written documentation is insufficient to verify compliance, the Controller (or an independent, certified third-party auditor mandated by the Controller who is not a competitor of Wispo and is bound by confidentiality) may conduct an audit upon at least thirty (30) calendar days' prior written notice, during normal business hours, without disrupting Wispo's operations or compromising the security of other merchants' data. Each Party bears its own audit costs.

4. Engagement of Sub-Processors

The Controller grants the Processor general written authorisation to engage the Sub-Processors listed in Annex 3 for the provision of the Services.

• 30-Day Advance Notice & Right to Object: Wispo shall inform the Controller (by updating Annex 3 and notifying Merchants via email or dashboard notice) at least thirty (30) calendar days prior to authorizing any new or replacement Sub-Processor. The Controller may object in writing on reasonable, substantiated data protection grounds within that 30-day window. If the Parties cannot resolve the objection amicably, the Controller may terminate the Principal Agreement prior to the new Sub-Processor commencing processing.
• Flow-Down Obligations & Liability: Wispo enters into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those set out in this DPA, and remains fully liable to the Controller for the performance of each Sub-Processor's data protection obligations.

5. International Data Transfers, Term & Post-Termination Deletion

5.1 Transfers Outside the EU/EEA: Wispo prioritizes processing Personal Data within the European Union and European Economic Area (EEA). Where any processing by an authorized Sub-Processor involves a transfer of Personal Data outside the EU/EEA to a country without an EU Adequacy Decision, Wispo ensures that the transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914) alongside a Transfer Impact Assessment (TIA) and supplementary encryption measures.

5.2 Term & 10-Day Deletion Upon Termination: This DPA remains in effect for as long as Wispo processes Personal Data on behalf of the Controller under the Principal Agreement. Within ten (10) calendar days following termination of the Principal Agreement (or upon the Controller's earlier written instruction), the Processor shall permanently delete or return all Personal Data processed solely in its role as Data Processor, unless retention is required by European Union or Estonian statutory law (such as the 7-year retention period under the Estonian Accounting Act for transaction records held by Wispo as Merchant of Record).

Annex 1 — Details of Personal Data Processing

Annex 2 — Technical and Organisational Security Measures (TOMs)

Annex 3 — List of Authorised Sub-Processors