Legal Center

Data Processing Agreement (DPA)

Last updated on 28th May 2026

DATA PROCESSING AGREEMENT

(hereinafter: DPA)

Effective Date: This DPA is effective as of the Subscription Effective Date set out in the applicable Order Form.

This DPA is concluded between:

Processor: Lexelerate OÜ, with its registered seat at Sepapaja 6, Lasnamäe District, Tallinn, Harju County, 15551, Estonia, company number 17224471 (hereinafter: Lexelerate or Processor); and

Controller: The Customer as identified in the applicable Order Form (hereinafter: Controller). Where the Parties have agreed to execute this DPA as a physical document, the Controller's details are:

RECITALS

A. The Contracting Parties have entered into a Subscription Agreement (the "Agreement") governing the provision of the Whisperly Software as a Service solution, under which the Processor processes personal data on behalf of the Controller and may, where applicable, transfer such personal data in accordance with applicable data protection laws.

B. The Contracting Parties have the capacity of Controller and Processor within the meaning of the General Data Protection Regulation 2016/679 (GDPR).

C. The GDPR obliges the Controller and Processor to conclude a written agreement regulating the subject and duration of processing, the nature and purpose of processing, the type of personal data and categories of data subjects, and the rights and obligations of the Controller.

D. The Contracting Parties have agreed to conclude this DPA to fulfil the obligations prescribed by the GDPR.

1Subject Matter of the Agreement

1.1 This DPA stipulates the rights and obligations of the Controller and Processor in the context of processing personal data.

1.2 This DPA applies to activities undertaken by the Processor or its authorised Subprocessors in relation to personal data processing.

1.3 All terms used in this DPA shall be interpreted in accordance with their meaning under the GDPR unless otherwise defined herein.

2Subject and Duration of the Data Processing

2.1 The subject of data processing is the personal data collected by the Controller in accordance with the GDPR in relation to the Agreement and the provision of the Service by the Processor (hereinafter: Controller's Personal Data).

2.2 Processing of the Controller's Personal Data shall begin on the Effective Date and shall continue until the expiration of the Agreement or, in case of termination, until the date of termination. The Controller has the obligation to notify data subjects that the Processor is authorised to process their personal data.

2.3 In the event of termination of the Agreement, the Processor shall immediately cease any further processing of the Controller's Personal Data, unless mandatory laws applicable to the Processor require otherwise.

3Nature and Purpose of the Data Processing

3.1 The Processor's processing of the Controller's Personal Data made available via the Whisperly Service may comprise any operation or set of operations performed on personal data, whether by automated means or otherwise, including collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, as necessary for the performance of the Agreement and in accordance with the Controller's documented instructions.

3.2 The Controller's Personal Data is processed for the purpose of providing the Service in accordance with the Agreement.

4Type of Personal Data and Categories of Data Subjects

4.1 The Processor shall process personal data submitted to or made accessible through the Service by the Controller, the scope and categories of which are determined exclusively by the Controller. Such personal data may include authentication data, identification and contact details, professional data, and other personal data uploaded by the Controller in connection with its use of the Service. The categories and extent of personal data processed depend on the Controller's configuration and use of the Service.

4.2 The data subjects may include employees, representatives, customers, or other individuals whose personal data the Controller processes in its capacity as controller or processor under applicable data protection law.

5Controller's Rights and Obligations

5.1 The Controller shall implement appropriate technical, organisational, and personnel measures to ensure that processing is performed in accordance with the GDPR, taking into account the nature, scope, context and purposes of processing as well as the risks for the rights and freedoms of natural persons.

5.2 The Controller shall adopt and enforce appropriate internal data protection policies and ensure that its personnel with access to Personal Data are subject to confidentiality obligations.

5.3 The Controller shall be solely responsible for determining the purposes and means of the processing of Personal Data and for ensuring that such processing, including the instructions given to the Processor, complies with applicable data protection laws. The Controller shall ensure that it has a valid legal basis for the processing and for transferring Personal Data to the Processor.

5.4 The Processor shall process Controller's Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by applicable law. Instructions shall be provided in writing, including by electronic means. The Processor shall not be required to follow instructions that are unlawful or outside the scope of the Agreement.

5.5 The Controller may, upon reasonable prior written notice and no more than once per calendar year (unless required by a competent supervisory authority or in case of a material Personal Data Breach), conduct an audit of the Processor's compliance with this DPA. The audit shall be conducted during normal business hours, shall not unreasonably interfere with the Processor's operations, and shall be limited to information strictly necessary to demonstrate compliance with this DPA. The Processor may satisfy audit obligations by providing relevant third-party audit reports, certifications, or summaries of security measures where appropriate.

6Data Processing Terms

6.1 The Processor is obliged to process the Controller's Personal Data only in accordance with the purpose of providing the Service and fulfilling the Agreement.

6.2 The Processor is obliged to process Controller's Personal Data only within the scope of the Controller's instructions, including instructions regarding the transfer of personal data to other countries or international organisations, unless the Processor is legally obliged to process the data. In such case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure on grounds of public interest.

7Data Processor's Obligations

The Processor is obliged:

7.1 to ensure that natural persons authorised to process Personal Data are bound by a duty of confidentiality;

7.2 taking into account the nature of the processing, to assist the Controller by applying appropriate technical, organisational, and personnel measures in fulfilling the Controller's obligations under the GDPR concerning data subject rights;

7.3 to assist the Controller in fulfilling obligations under the GDPR relating to the security of processing, notifying the competent supervisory authority and data subjects of a Personal Data Breach, conducting data protection impact assessments, and prior consultations with competent supervisory authorities, taking into account the nature of the processing and information available to the Processor;

7.4 to make available to the Controller all information necessary to demonstrate the fulfilment of the Processor's obligations and to enable and contribute to audits carried out by the Controller or a person authorised by the Controller;

7.5 to inform the Controller if it believes an instruction infringes the GDPR or other applicable Union or Member State data protection provisions;

7.6 to notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of any request, complaint, or other communication from (i) a data subject, (ii) a competent supervisory authority, or (iii) any other public authority, insofar as such request relates to the processing of Personal Data on behalf of the Controller. The Processor shall not respond to such request except on the Controller's documented instructions or as required by applicable law;

7.7 upon termination of contractual processing activities, to delete and/or return all Personal Data (including copies thereof) to the Controller, unless retention is required by applicable law.

8Lexelerate as Independent Data Controller

This DPA governs Lexelerate's processing of Personal Data in its capacity as a data processor. In addition to and independently of its processor role, Lexelerate processes certain personal data as an independent data controller within the meaning of Article 4(7) GDPR for the following limited purposes, each governed by the Whisperly Privacy Notice for Platform Users (available at https://whisperly.ai/legal-center): (a) service improvement, (b) security purposes and fraud prevention, (c) Customer relationship management, (d) defence against legal claims and compliance with legal obligations, and (e) platform security, session management, and protection against unauthorised access and abuse through technical cookies set on users' devices.

8.2 For the processing activities described in clause 8.1, Lexelerate is the data controller and the Controller bears no responsibility for such processing. Lexelerate processes such data only to the extent necessary for each stated purpose and in accordance with applicable data protection law.

9Confidentiality and Non-Disclosure Obligation

9.1 The Processor shall take reasonable steps to ensure the confidentiality of any employee, agent, or Subprocessor who may have access to the Controller's Personal Data, limiting access strictly to those individuals who need it.

9.2 The Processor warrants that all individuals who process the Controller's Personal Data: (a) are informed about the confidential nature of the data and aware of the Processor's obligations under the Agreement; and (b) have concluded a non-disclosure agreement with the Processor.

10Security of Processing

10.1 The Processor shall implement appropriate technical, organisational, and personnel measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The exhaustive description of technical and organisational measures is set out in Appendix 2 to this DPA.

10.2 Where necessary, the measures referred to in clause 10.1 shall include: (a) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (b) the ability to promptly restore the availability and access to Personal Data in the event of a physical or technical incident; and (c) a process for regularly testing, assessing, and evaluating the effectiveness of technical, organisational, and personnel measures for ensuring the security of the processing.

11Subprocessors

11.1 The Controller provides the Processor with a general authorisation to engage Subprocessors for the processing of Personal Data in connection with the provision of the Service. The current list of Subprocessors is maintained and made publicly available in the Whisperly Trust Center at https://trust-center.whisperly.ai/.

11.2 The Processor shall inform the Controller of any intended addition or replacement of Subprocessors at least fifteen (15) days prior to such engagement. The Controller may object to the proposed Subprocessor on reasonable data protection grounds within such period. In such case, the Parties shall work in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the affected Service in accordance with the Agreement.

11.3 Where the Processor engages a Subprocessor, it shall enter into a written agreement imposing data protection obligations no less protective than those set out in this DPA, including obligations regarding: processing only on documented instructions; confidentiality; implementation of appropriate technical and organisational measures; assistance with data subject rights and security obligations; and deletion or return of Personal Data upon termination. The Processor remains fully liable to the Controller for the performance of the Subprocessor's obligations.

12Personal Data Breach

12.1 The Processor shall notify the Controller of any confirmed Personal Data Breach without undue delay after becoming aware of it, and in any event within forty-eight (48) hours of the Processor becoming aware, providing at minimum: (a) a description of the nature of the breach, including where possible the categories and approximate number of data subjects concerned and the records affected; (b) the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) the likely consequences of the breach; (d) the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

12.2 Where information cannot be provided simultaneously, the Processor shall provide it in phases without further undue delay. The Processor shall document all Personal Data Breaches.

12.3 The Processor shall not notify data subjects or any third party regarding a Personal Data Breach without the Controller's prior written instruction, unless required to do so by applicable law.

12.4 Lexelerate's liability arising from or in connection with a Personal Data Breach shall be subject to the liability limitations set out in the Agreement.

13Data Transfers

13.1 The Processor may transfer, or permit access to, Personal Data outside the European Economic Area (EEA) where such transfer is necessary for the provision of the Services and is carried out in compliance with Chapter V GDPR.

13.2 The Controller provides a general authorisation for such transfers, provided that the Processor implements appropriate safeguards in accordance with applicable data protection law. Where Personal Data is transferred to, or accessed from, a third country that does not benefit from an adequacy decision under Article 45 GDPR, the Processor shall ensure that one or more of the following mechanisms applies: (a) the European Commission's Standard Contractual Clauses (2021/914); (b) reliance on an adequacy decision; (c) certification under the EU-U.S. Data Privacy Framework or another approved framework; or (d) any other lawful transfer mechanism under Chapter V GDPR.

13.3 The Processor shall implement supplementary technical and organisational measures where required to ensure a level of protection essentially equivalent to that guaranteed within the EEA, and shall maintain documentation of the applicable transfer mechanism available to the Controller upon request.

14Final Provisions

14.1 This DPA forms an integral part of the Agreement. In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall prevail with respect to the subject matter of data protection and processing of Personal Data.

14.2 This DPA may be amended only by a written agreement signed by both Parties. The Processor may update this DPA where necessary to reflect changes in applicable data protection law or transfer mechanisms, provided that such updates do not materially reduce the level of protection afforded to Personal Data.

14.3 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. The Parties shall replace the invalid provision with a valid provision that most closely reflects the original intent.

14.4 The Processor may assign this DPA in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided the successor assumes the Processor's obligations. The Controller may not assign this DPA except together with the Agreement.

14.5 This DPA shall be governed by and construed in accordance with the governing law specified in the Agreement, unless otherwise required by applicable data protection law.

14.6 This DPA may be executed in counterparts, including by electronic signature or exchange of signed copies via electronic means. Each signed copy shall be deemed an original, and all counterparts together constitute one instrument.

14.7 Where the Customer accesses the Service pursuant to a Subscription Agreement that incorporates this DPA by reference, such access shall constitute the Customer's execution of and agreement to this DPA, even where this DPA has not been separately signed by the Parties. In such case, this DPA shall be binding on the Parties as of the date of the Customer's first access to the Service.

APPENDIX 1: Description of Processing Activities

This Appendix is provided for the purposes of Annex I to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).

A. List of Parties

B. Description of the Processing

C. Competent Supervisory Authority

The competent supervisory authority for the Processor is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia (https://www.aki.ee/).

APPENDIX 2: Technical and Organisational Measures

This Appendix describes the technical and organisational measures implemented by the Processor in accordance with Articles 25 and 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.

1. Cloud Infrastructure & Architecture

• The Service is provided exclusively as a cloud-based solution hosted on Amazon Web Services (AWS). The Processor does not operate its own production data centres.
• Security responsibilities follow the cloud shared responsibility model: AWS is responsible for security of the cloud (physical security, infrastructure, hardware, hypervisor); the Processor is responsible for security in the cloud (access management, encryption, system hardening, logging, monitoring, application security, backups).
• Controller Personal Data is hosted in AWS data centres located within the European Union unless otherwise agreed in writing.

2. Governance & Risk Management

• The Processor maintains documented information security policies covering risk management, access control, cryptography, incident response, change management, business continuity, and supplier security.
• Risk assessments are conducted periodically and upon material system or architectural changes. Roles and responsibilities for information security are formally assigned.

3. Data Protection by Design and by Default

• The Service is designed to support role-based access control, logical segregation of customer environments, configurable retention controls, and encryption by default. Default system configurations are privacy protective.

4. Identity & Access Management

• Access to Personal Data is restricted on the principle of least privilege. Unique user accounts are required for all authorised personnel. Multi-factor authentication (MFA) is mandatory for administrative and remote access to production systems. Access rights are subject to periodic review and promptly revoked upon role change or termination. All privileged access activities are logged and monitored.

5. Encryption & Key Management

• Personal Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 or equivalent. Encryption keys are managed via secure key management systems (AWS KMS or equivalent) with access strictly restricted and logged. Authentication credentials are protected using strong one-way hashing and salting.

6. Network & Infrastructure Security

• Production, staging, and development environments are logically separated. Network access is restricted through firewalls, security groups, and network access control mechanisms. Administrative access is monitored and public exposure is limited to service endpoints necessary for operation.

7. Logging & Monitoring

• Security-relevant events are logged, including authentication attempts, administrative actions, configuration changes, and key management actions. Logs are protected against unauthorised access and monitoring mechanisms are implemented to detect and respond to anomalous activity.

8. Secure Development Lifecycle

• Security controls are integrated into development processes, including code review, dependency and vulnerability management, and change management controls. Production Personal Data is not used in development environments unless strictly necessary and subject to appropriate protections.

9. Backup, Availability & Resilience

• Regular backups are performed, encrypted, and periodically tested for recoverability. The Processor maintains business continuity and disaster recovery procedures to ensure appropriate availability, integrity, and resilience.

10. Incident Response & Breach Management

• The Processor maintains documented incident response procedures, classifies and escalates incidents based on severity, and cooperates with the Controller in the investigation, containment, remediation, and notification processes in the event of a Personal Data Breach.

11. Subprocessor & International Transfer Safeguards

• Subprocessors are engaged only under written agreements that impose data protection obligations no less protective than those set out in this DPA and in compliance with Article 28(4) GDPR. Where Personal Data is transferred outside the EEA or accessed from outside the EEA, the Processor ensures that appropriate safeguards under Chapter V GDPR are implemented, including (where required) reliance on an adequacy decision and/or the European Commission's Standard Contractual Clauses, and that supplementary technical and organisational measures (including strong encryption and restricted access controls) are applied where necessary to ensure an essentially equivalent level of protection. The Processor also performs appropriate due diligence prior to engaging Subprocessors and maintains ongoing oversight proportionate to the risk.

APPENDIX 3: List of Authorised Subprocessors

The Controller grants the Processor a general written authorisation to engage Subprocessors. The Processor shall inform the Controller of any intended addition or replacement of Subprocessors at least 15 days before the new Subprocessor processes any personal data. The Controller may object within that period on reasonable data protection grounds. Failure to object within the notice period shall be deemed acceptance.

Current subprocessor list: The current and up-to-date list of subprocessors is maintained and publicly available at the Whisperly Trust Center: https://trust-center.whisperly.ai/. You may also request the current list by contacting office@lexelerate.ai.