Data Processing Agreement

Last updated: April 8, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between System9, Inc. (“SYSTEM9” or “Processor”) and the Customer (“Controller”) for the provision of Services, and reflects the parties' agreement with regard to the processing of personal data in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Definitions

• Controller: The Customer, who determines the purposes and means of the processing of personal data.
• Processor: System9, Inc., which processes personal data on behalf of the Controller in connection with the provision of Services.
• Personal Data: Any information relating to an identified or identifiable natural person (“Data Subject”), as defined by applicable data protection law.
• Processing: Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• Sub-Processor: Any third party engaged by SYSTEM9 to process personal data on behalf of the Controller.
• Data Subject: An identified or identifiable natural person whose personal data is processed.

2. Scope and Purpose

This DPA applies to the processing of personal data by SYSTEM9 on behalf of the Customer in connection with the provision of the Services as described in the applicable subscription agreement or order form. The nature, purpose, duration, and categories of personal data processed are determined by the Controller and documented in the applicable agreement.

SYSTEM9 processes personal data solely for the purpose of providing, maintaining, and improving the Services as instructed by the Controller, and not for any independent purpose.

3. Processor Obligations

3.1 Processing on Instructions

SYSTEM9 shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by applicable law. In such a case, SYSTEM9 shall inform the Controller of the legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

3.2 Confidentiality

SYSTEM9 shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to personal data is restricted to personnel who require it for the performance of their duties.

3.3 Security Measures

SYSTEM9 shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data at rest and in transit.
• Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
• Procedures for regularly testing, assessing, and evaluating the effectiveness of security measures.
• Processes for restoring the availability and access to personal data in a timely manner in the event of a physical or technical incident.

3.4 Sub-Processor Management

SYSTEM9 shall not engage another processor (sub-processor) without prior specific or general written authorization of the Controller. In the case of general written authorization, SYSTEM9 shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes. SYSTEM9 shall impose the same data protection obligations on sub-processors as set out in this DPA.

3.5 Data Subject Requests

SYSTEM9 shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures for the fulfillment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under applicable data protection law (including rights of access, rectification, erasure, restriction, portability, and objection).

3.6 Breach Notification

SYSTEM9 shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's personal data. The notification shall include:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned.
• The name and contact details of the point of contact.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its effects.

4. Customer Obligations

The Controller shall:

• Ensure that the processing of personal data is lawful and that all necessary consents, authorizations, and legal bases have been obtained.
• Provide documented instructions to SYSTEM9 regarding the processing of personal data.
• Comply with all applicable data protection laws with respect to the personal data processed through the Services.
• Notify SYSTEM9 promptly of any changes to applicable data protection requirements that may affect SYSTEM9's obligations under this DPA.

5. Sub-Processors

A current list of sub-processors used by SYSTEM9 is available upon request. SYSTEM9 will provide at least thirty (30) days' advance notice before adding or replacing a sub-processor. If the Controller objects to a new sub-processor on reasonable data protection grounds, SYSTEM9 will make commercially reasonable efforts to provide an alternative or allow the Controller to terminate the affected Services without penalty.

6. International Transfers

SYSTEM9 shall not transfer personal data to a country outside the European Economic Area (EEA) or the United Kingdom unless appropriate safeguards are in place. Where transfers are necessary, SYSTEM9 will rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational measures where required by applicable law.

7. Data Retention and Deletion

Upon termination of the Services or upon the Controller's written request, SYSTEM9 shall, at the Controller's choice, return all personal data to the Controller or securely delete all personal data, and delete existing copies unless applicable law requires retention. SYSTEM9 will provide a certificate of deletion upon request.

The Controller will have a period of thirty (30) days following termination to request the return of personal data. After this period, SYSTEM9 may securely delete all remaining personal data in accordance with its data retention schedule.

8. Audit Rights

SYSTEM9 shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller.

Audits shall be conducted with reasonable advance notice (not less than thirty (30) days), during normal business hours, and in a manner that does not unreasonably disrupt SYSTEM9's operations. The Controller shall bear the costs of any audit unless the audit reveals a material breach of this DPA by SYSTEM9.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set forth in the applicable subscription agreement or Terms of Service. Nothing in this DPA limits either party's liability for breaches of data protection law to the extent such limitation is prohibited by applicable law.

10. Term

This DPA shall remain in effect for the duration of SYSTEM9's processing of personal data on behalf of the Controller. The obligations imposed on SYSTEM9 under this DPA with respect to the processing of personal data shall continue for as long as SYSTEM9 retains any personal data processed on behalf of the Controller.

11. Contact

For questions about this Data Processing Agreement or to exercise your rights, please contact us:

System9, Inc.
Email: contact@system9.ai
Website: system9.ai