Global Data Processing Addendum (DPA)

This DPA supplements the principal agreement governing client use of Valueye software, SaaS platforms, or custom engineering services. It applies whenever Valueye processes Personal Data subject to international Data Protection Laws in the course of providing services to Customer.

For the purposes of applicable Data Protection Laws: Customer acts as the Data Controller (or Business / Responsible Party), and Valueye acts as the Data Processor (or Service Provider / Operator). Valueye shall process Personal Data solely on documented, lawful instructions from Customer, including with respect to international transfers, unless required to do so by applicable statutory law.

Valueye designs its software systems and deployment architectures to comply with international data privacy and security benchmarks across multiple jurisdictions:

• 01European Economic Area (EEA): Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).
• 02United Kingdom: UK GDPR and Data Protection Act 2018.
• 03Switzerland: Swiss Federal Act on Data Protection (FADP).
• 04United States: California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and applicable state privacy statutes (Virginia VCDPA, Colorado CPA, Connecticut CTDPA).
• 05Middle East & GCC: United Arab Emirates Federal Decree-Law No. 45/2021, Dubai International Financial Centre (DIFC) Data Protection Law No. 5/2020, and Saudi Arabia Personal Data Protection Law (PDPL).
• 06Asia-Pacific: Singapore Personal Data Protection Act 2012 (PDPA) and Australian Privacy Act 1988.

Where customer elects to deploy software across international boundaries, or where data is accessed from outside the jurisdiction of origin, the parties agree to implement recognized legal transfer mechanisms:

• 01EU Standard Contractual Clauses (SCCs): The parties incorporate by reference the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), specifically Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Processor), which are deemed fully executed and binding.
• 02UK International Data Transfer Addendum: For transfers governed by UK law, the UK Information Commissioner's Office (ICO) International Data Transfer Addendum to the EU Commission SCCs is incorporated.
• 03Swiss Addendum: References to the GDPR and supervisory authorities shall be read to incorporate the Swiss FADP and Federal Data Protection and Information Commissioner (FDPIC).
• 04Supplemental Technical Measures: All cross-border data streams are protected using TLS 1.3 encryption in transit with Perfect Forward Secrecy (PFS) and AES-256 encryption at rest, preventing intercepting entities from gaining intelligible access.

Valueye maintains comprehensive technical and organizational safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, alteration, or disclosure:

• 01Access Control & Authentication: Strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) on all production gateways, and least-privilege administrative access policies.
• 02Cryptographic Security: Mandatory AES-256 encryption at rest for database clusters, file storage, and backup snapshots; TLS 1.3 for all external and internal API communications.
• 03Vulnerability Management: Automated continuous dependency vulnerability scanning, regular static and dynamic code analysis (SAST/DAST), and periodic third-party penetration testing.
• 04Audit Logging & Monitoring: Comprehensive immutable audit logs recording administrative access, authentication attempts, and data schema modifications with centralized real-time alerting.

Customer grants Valueye general written authorization to engage third-party infrastructure sub-processors (e.g. cloud hosting providers such as AWS, Google Cloud, or Microsoft Azure) to provide hosting, database, and telemetry infrastructure.

• 01Flow-Down Obligations: Valueye enters into written agreements with every sub-processor imposing data protection terms no less protective than those contained in this DPA.
• 02Zero Third-Party Marketing Trackers: Valueye does not employ third-party advertising SDKs, behavioral profiling trackers, or marketing analytics scripts on enterprise software surfaces.
• 03Notification of Changes: Valueye shall notify customer of any planned addition or replacement of infrastructure sub-processors at least thirty (30) days in advance, providing customer an opportunity to object on reasonable privacy or security grounds.

In the event Valueye becomes aware of a confirmed Security Incident resulting in unauthorized access to, alteration, disclosure, or destruction of Customer Personal Data, Valueye shall:

• 01Notify customer without undue delay and in any event within forty-eight (48) hours of becoming aware of the confirmed breach.
• 02Provide timely details regarding the nature of the incident, affected data categories, estimated number of affected data subjects, and likely operational impact.
• 03Take prompt, diligent remedial measures to contain and mitigate the effects of the incident.
• 04Assist customer in fulfilling any statutory breach reporting obligations to international data protection authorities (e.g. EU DPAs, UK ICO, FTC, state attorneys general) or affected data subjects.

Valueye provides technical capabilities within its software (including self-service administrative exports, pseudonymization, and selective deletion APIs) to enable Customer to fulfill requests from data subjects exercising their legal rights (access, rectification, erasure, portability, objection, or restriction).

Upon termination of the service agreement, Valueye shall, at Customer's election, securely return all Customer Personal Data in a standard machine-readable format or perform certified cryptographic deletion of all copies from production and backup systems within thirty (30) days, unless retention is mandated by applicable statutory law.

Upon reasonable written notice (not less than thirty (30) days) and subject to mutual non-disclosure obligations, Valueye shall make available to Customer information necessary to demonstrate compliance with this DPA. For regulated enterprise clients, Valueye accommodates independent third-party audits of security policies, system architecture, and compliance documentation once per calendar year.