process personal data only on Customer's documented instructions, including as to transfers to third countries, and inform Customer if an instruction appears to infringe data protection law;

ensure persons processing the data are bound by confidentiality;

implement appropriate technical and organizational measures under Article 32 GDPR, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls with MFA, logging, and storage and processing exclusively within the EU/EEA, and not use Customer Data to train AI models;

engage only the sub-processors listed below, bound by written terms imposing substantially the same obligations, and give Customer 30 days' prior notice of changes, to which Customer may object on reasonable data protection grounds;

taking into account the nature of the processing, assist Customer with data subject requests under Articles 15–22 GDPR;

assist Customer with its obligations under Articles 32–36 GDPR, and notify Customer without undue delay, where feasible within 48 hours, after becoming aware of a personal data breach;

upon termination of the Agreement, delete or, at Customer's choice, return all personal data (deletion by default 30 days after termination absent instructions), unless law requires storage; and

make available to Customer the information necessary to demonstrate compliance with this DPA and allow and contribute to audits conducted by Customer or its mandated auditor, once per year on 30 days' notice at Customer's cost.