Data processing agreement (DPA)

1. Parties, scope and precedence

The controller is the legal entity or business clearly identified in the relevant QORLYNT order or the stored electronic DPA acceptance record, including its business address and authorized representative (customer). The processor is Smart TB Tech UG (haftungsbeschränkt), Oberviehhausen 7, 84533 Haiming, Germany, represented by Bernhard Waldherr and Thomas Elbl; contact: support@qorlynt.com. Use that address for data protection enquiries and instructions; security incidents may additionally be reported to support@qorlynt.com.

This DPA applies to personal data processed by Smart TB Tech on behalf of the customer when using subscribed QORLYNT services. It supplements the order and terms. For commissioned processing, this DPA and its annexes prevail over inconsistent terms. A documented individual data protection arrangement agreed by both parties prevails where lawful. Data subjects' statutory rights remain unaffected.

The DPA is concluded in text form or through a verifiable electronic process. The approved version, Annex 3, customer identity, acceptance time and authorized person must be recorded and made available to the customer. Amendments require effective agreement; publishing a new web version does not automatically change existing DPAs.

2. Subject matter, duration and roles

The engagement covers provision, hosting, operation, backup and support of the customer's subscribed QORLYNT functions. Processing starts when this DPA is effectively concluded and generally ends when the engagement and steps under section 12 end. Annex 1 specifies nature, purposes, people and data categories; inactive or unused features do not automatically extend the engagement.

The customer determines purposes, permitted data, legal bases, retention decisions, recipients and communication channels. Smart TB Tech determines non-essential technical and organisational means of delivering the service and processes commissioned data solely on documented instructions. Its own contractual, billing, support and security processing is subject to its independent controllership and the QORLYNT privacy notice; actual purposes determine the distinction.

With customer-connected Google, Microsoft, Meta, Telegram, SMTP/IMAP, Stripe, OpenAI or other accounts, a provider may also process data as an independent controller. The customer must examine roles and contracts for its configuration. Section 7 and Annex 3 apply where QORLYNT engages a third party for commissioned processing. A recipient selected by the customer does not automatically become Smart TB Tech's subprocessor.

3. Instructions and unlawful instructions

Agreed use of functions, authorized settings, confirmed imports, connections, exports and deletions and this DPA constitute initial documented instructions. Additional instructions may be issued only by authorized customer representatives in text form to support@qorlynt.com or through approved traceable product functions. Smart TB Tech records material instructions and may reasonably verify authority. Oral instructions must promptly be confirmed by the customer in text form.

Instructions outside the agreed scope are coordinated for feasibility and any transparently agreed fees before execution; mandatory assistance is not excluded. If Smart TB Tech considers an instruction to infringe GDPR or other EU or Member State data protection law, it informs the customer without undue delay where legally permitted and may suspend that instruction pending clarification. If law requires processing without instructions, it informs the customer before processing unless that law prohibits such information on important public interest grounds.

4. Confidentiality and authorized access

Smart TB Tech grants access only to persons who need it for the engagement. Authorized persons must be bound to confidentiality in advance or subject to appropriate statutory secrecy, continuing after their role ends. Permissions are assigned by task, reviewed and revoked when no longer needed. Authorized persons receive suitable data protection and security instructions.

Public sample data or support requests are not blanket permission to use customer data for Smart TB Tech advertising, unrelated AI training or other independent purposes. Maintenance, troubleshooting and incident access are limited to what is necessary and reasonably traceable.

5. Technical and organisational measures (TOMs)

Smart TB Tech applies and maintains measures described in Annex 2 pursuant to Article 32 GDPR, considering risk, state of the art, implementation cost and nature, scope, context and purposes of processing. These include confidentiality, integrity, availability and resilience, restoration and regular effectiveness assessment. The annex defines a contractual level of security; it is not evidence of unverified production settings, certification or exact restoration times.

Measures may evolve or be replaced by equivalent or stronger measures without reducing the agreed protection. Material reductions are communicated beforehand and require a legally effective arrangement. Smart TB Tech demonstrates implementation on request with suitable current documentation and audit evidence. The customer remains responsible for secure roles, user accounts, its own integration credentials and assessing particular data risks.

6. International transfers

Processing or access outside the EEA occurs only on the customer's documented instructions or binding legal obligation and in compliance with GDPR Chapter V. Approval of an authorized subprocessor, including required third-country access for its service, counts as an instruction only within the scope actually disclosed. Annex 3 identifies recipients, processing/access countries and the applicable transfer mechanism for each approved service; actual contracting entities and agreements must be verified before approval.

Adequacy decisions apply only within their actual personal and material scope. Standard contractual clauses require relevant assessments and supplementary measures where necessary. This DPA is not itself the standard contractual clauses for international transfers. Smart TB Tech supplies necessary information and applicable safeguards, including relevant extracts, on request. Transfers without a valid legal basis will not occur.

7. Subprocessors and changes

The customer grants general written authorization only for subprocessors and activities identified in the version of the standardized Annex 3 made available and accepted when this DPA is concluded, insofar as the relevant function is used for the customer's processing. Before engagement, their identity, address, contact, activity, locations and applicable transfer safeguards must be disclosed. Annex 3 must also cover further relevant tiers of the processing chain and be kept current. General authorization is not permission for unknown providers.

Smart TB Tech actively informs each affected customer in text form of intended additions or replacements generally at least 30 calendar days before deployment, including identity, service, location and safeguards. The customer may object for substantive data protection reasons within 20 calendar days of receipt; timely objections are considered before deployment. The parties seek a reasonable solution such as another configuration. If none is available, the customer may terminate the affected service extraordinarily before the change. Emergency security changes are communicated as early as possible; any legally required authorization remains necessary. Merely updating this website is not an active change notice.

Smart TB Tech binds each subprocessor by an agreement imposing essentially equivalent Article 28(4) GDPR obligations and checks adequate guarantees. It remains liable to the customer for the subprocessor's data protection performance. The customer receives information reasonably needed to assess the engaged entities and downstream chain on justified request, subject to reasonable confidentiality measures.

8. Data subject rights and requests

As controller, the customer is responsible for Articles 13/14 GDPR notices and decisions on access, rectification, erasure, restriction, portability and objections. Smart TB Tech assists, having regard to the nature of processing and available information, by appropriate technical and organisational measures. Requests can be sent to support@qorlynt.com; identity and authority checks are proportionate.

When an identifiable request about customer data reaches Smart TB Tech directly, it informs and forwards it to the customer without undue delay through an appropriate secure channel unless law requires a different approach. It does not independently decide the substance of a customer-data request unless authorized or legally required. The customer's statutory response periods continue to apply. Self-service features alone do not guarantee complete erasure or a complete data copy.

9. Personal data breaches and security incidents

Smart TB Tech reports a breach of commissioned personal data to the customer without undue delay after becoming aware of it, through the registered responsible security contact and where necessary another reliable channel. Initial notification contains then-available facts, with updates without undue delay. Where known, it covers nature and scale, categories and approximate numbers of people and records, contact point, likely consequences and measures taken or proposed. Incomplete root-cause analysis does not delay initial notice.

Smart TB Tech assists investigation, containment, documentation and the customer's obligations under Articles 33 and 34 GDPR; decisions and deadlines for notifying authorities and individuals rest with the controller. Smart TB Tech's independent statutory notification duties remain unaffected. The customer maintains a reachable security contact and reports incidents it discovers where necessary for the engagement.

10. Further assistance and evidence

Smart TB Tech assists the customer, taking account of available information and nature of processing, with Article 32 security, Article 35 data protection impact assessments and, where applicable, Article 36 prior consultation. It makes information needed to demonstrate Article 28 compliance available and promptly informs the customer of an instruction it considers unlawful. The customer assesses the legal risk of its specific use.

Reasonable enquiries and assistance are coordinated via support@qorlynt.com. For work beyond ordinarily agreed obligations the parties may agree reasonable charges disclosed in advance; failure to agree fees must not undermine mandatory assistance.

11. Inspections and audits

Smart TB Tech allows and contributes to audits including inspections by the customer or an independent auditor mandated by it under Article 28(3)(h) GDPR. Suitable current evidence and remote audit may be used first; if insufficient for necessary verification, a reasonably broader inspection is enabled. Scope and timing take account of security, other customers' confidentiality and operations. A serious concrete incident or reasonable indication of significant deficiencies requires timely examination.

The customer binds auditors to confidentiality; inspections cannot access other tenants' data or expose protective secrets disproportionately. These conditions do not remove the statutory audit right. Deficiencies and remedies are documented and coordinated in a reasonable time. Competent supervisory authority powers remain unaffected.

12. Return, erasure and termination

At the end of commissioned processing, Smart TB Tech returns all commissioned personal data in a suitable agreed format or deletes it, at the customer's documented choice, and deletes existing copies unless EU or Member State law requires retention. The customer can submit its choice in good time. If no choice is received, Smart TB Tech requests a decision; missing response cannot defeat legally required erasure or mandatory retrieval/switching rights. A contact CSV alone is not a full export.

The process respects statutory Data Act retrieval and switching rights, contractual periods and secure transfer. Data required by law remains limited to the relevant purpose, accessible only as needed and retained no longer than required. Backups are retired and deleted under the documented backup cycle, with no routine use pending deletion. Erasures already completed must be reapplied after restoration. Smart TB Tech confirms the steps taken on request. Actual production periods and complete inventories must be documented and evidenced in an operational deletion policy.

Disconnecting an integration, cancelling an add-on, removing a contact or closing an account does not automatically return or erase all commissioned data. Independent processing and data at independently responsible providers follow their respective legal bases and contracts.

13. Liability, term and final rules

This DPA applies for as long as Smart TB Tech processes commissioned data under QORLYNT, including required winding down. Article 82 GDPR and mandatory claims of data subjects remain unaffected. Otherwise the parties' effectively agreed contractual conditions apply insofar as mandatory GDPR duties are not restricted. German law applies subject to mandatory data protection law.

The customer identifies reachable instruction and incident contacts when contracting and keeps them current. Annex 3 and any customer-specific provisions on sensitive data, processing locations and additional safeguards must be complete before the affected processing. High-sensitivity uses requiring extra safeguards must be documented and agreed before activation.

Annex 1 – Description of processing

For multiple locations, processing additionally includes location assignments for staff, calendars, booking links, communication channels and permissions. Optional online meetings process organizer, attendee and appointment data, meeting links and synchronization records for Google Meet or Microsoft Teams. Teams notifications and bot links process provider, user, conversation and destination identifiers, commands, responses, account and location grants and delivery records. The customer determines the authorized recipients and participants.

Authorized MCP access and incoming/outgoing automation webhooks may exchange selected contacts, availability, appointments, callback/handoff tasks and status data with customer-authorized applications. Processing also includes permissions, confirmations, mappings, destination addresses, request/response and retry records. Optional review requests process necessary contact/appointment data, review links, channel/template settings and sending/suppression records. Technical authorization does not replace required advertising consent or a lawful transfer basis. External recipients' roles and agreements must be assessed under sections 2, 6 and 7; this description does not approve Annex 3.

Optional AI telephone answering additionally covers real-time speech processing, connection routing, appointment intake, callback tasks and explicitly configured notifications. Data subjects also include callers and persons named for telephone number registration. Processing includes audio during the conversation, necessary AI context, confirmed names and callback numbers, call identifiers, status, duration and usage, and encrypted registration details and evidence. QORLYNT stores no complete call recordings or transcripts. Temporary tool results are deleted after seven days and local call metadata after 90 days from the earlier of confirmed completion and the scheduled deadline; confirmed appointments, contacts and tasks follow separate customer instructions and retention rules. Local document originals are removed after successful evidence approval and registration details on successful number provisioning. Incomplete setup and independent provider retention require separate consideration.

Subject and purpose: tenant-specific SaaS provision for customer/team administration, appointments and resources, booking pages, calendar sync, chats and business messaging, templates and campaigns, rules and workflows, authorized AI assistance, optional integrations, message dispatch, operational/security records and support at the customer's request. Operations include collection, import, organization, storage, synchronization, display, analysis, drafting, transfer to configured recipients, correction, export, blocking and erasure. Active functions and plans determine the actual scope.

Data subjects: customer staff and authorized users; their customers, prospects, booking users, chat/messaging partners, business contacts and potentially third parties in calendars, messages, imports and customer workflows. Data categories: names, contact details, business and role information, shifts/availability, services and bookings, calendar events and attendees, communication and consent records, chats and media, booking/support content, technical IDs, integration mappings, workflow events/logs, protected credentials and customer-supplied AI context and outputs.

Article 9 special categories and Article 10 data are not required by the standard service. Free text, bookings, media and imports may nevertheless contain them. The customer may enable such processing only with its own lawful basis and prior assessment of suitable additional safeguards; suitability for medical or other highly sensitive applications is not generally promised. Children may exceptionally appear in customer data; QORLYNT is not specifically commissioned as a children's service.

Resumable contact imports temporarily store normalized mapped rows and preview/error data on the server before confirmed application; manual booking approval processes the pending request, decision and notices to the business and booking person. These processes are part of the customer engagement, separate from Smart TB Tech’s own contract-cancellation handling.

Optional web push matches customer-initiated business events to notification categories and registered devices of authorized users; technical push endpoints and delivery records are used to forward generic notices without customer or appointment details. User activation and customer settings determine actual use. Optional sending via a QORLYNT sender address additionally processes sender and verified reply addresses, recipients, content, sending and delivery status, and bounce, complaint and suppression records on customer instructions. The address provides outbound sending, not an inbound mailbox.

Retention of business content follows documented customer instructions and effectively agreed product functions. Technical records, backups and connected-provider data require separate assessment. Duration: contract term plus lawful winding down, retrieval/switching phases and legally necessary retained records under section 12.

Annex 2 – Technical and organisational measures

Access and confidentiality: organizational identity and roles, server-side authorization and tenant checks, limited admin rights, encrypted transmission, protected secrets and encrypted integration credentials, appropriate staff obligations and traceability of privileged access. Production permissions and keys follow least privilege and are revoked on role change. Actual key management, cloud regions and any multifactor requirements must reflect production.

Integrity and purpose limitation: tenant separation, input validation and protection of external endpoints, signed webhooks where supported, authorization before access/changes, limited transfer to active integrations, event/change records and separate handling of consent, marketing objections and erasure. Logs and support copies are minimized; protection of API keys and rejection of unauthorized access are regularly assessed.

Availability and recovery: versioned, access-protected backups, defined recovery procedures, monitoring, incident handling and protection against unauthorized modification. Recovery tests and backups must be carried out under a documented operations profile. This DPA does not promise unconfirmed exact RPO, RTO or deletion periods; the actual production values and storage locations must be provided to the customer on request.

Effectiveness reviews: risk-based regular review of permissions, security updates, vulnerabilities and events; recovery and erasure testing, subprocessor oversight and documented remediation. The customer must receive a current and accurate account of the TOMs actually operated before or at contracting. Controls not yet implemented must not be represented as implemented.

Provider annex – 2026-10-24

Contracting entity: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg Privacy contact: aws-EU-privacy@amazon.com Service and purpose: Hosting the QORLYNT application, database and files, authentication, key management, and platform/commissioned email delivery through SES/SNS. Data and people: User, business, contact, appointment, staff, message and file data, plus technical usage data. Data subjects are the customer's users, employees and contacts, to the extent the respective features are used. Condition of use: Core QORLYNT operations; customer-related email delivery only within the commissioned scope. Processing locations: Regional application resources: Sweden, Stockholm (eu-north-1), as confirmed by the operator. This does not fully cover global administration, support or message delivery. Access countries: QORLYNT administration: Germany. AWS infrastructure in Sweden; support involving data shared for that purpose may operate from AU, CA, CR, DE, EG, FR, HK, IE, IN, IT, JP, KR, TW, US and ZA (ISO country codes). AWS support is not limited to Stockholm. Transfer bases and safeguards: AWS Data Processing Addendum, including its EU Standard Contractual Clauses for covered international transfers. Agreement and safeguards: https://aws.amazon.com/compliance/gdpr-center/ Further processing chain: Stockholm: Amazon Data Services Sweden AB (SE). For Route 53 domain registration: Key-Systems GmbH (DE); DNS alone is not registration. Data shared with AWS support may involve: Amazon.com Services LLC (US); Amazon Data Services SA (Pty) Ltd (ZA); Amazon Development Centre (India) Private Limited (IN); Amazon Development Centre Ireland Limited (IE); Amazon Development Centre (South Africa) (Proprietary) Limited (ZA); Amazon Internet Services Private Limited (IN); Amazon Support Services Costa Rica, SRL (CR); Amazon Web Services Australia Pty Ltd (AU); Amazon Web Services Canada, Inc. (CA); Amazon Web Services EMEA SARL (FR, DE, IE, IT); Amazon Web Services Hong Kong Limited (HK); Amazon Web Services Japan G.K. (JP); Amazon Web Services Korea LLC (KR); Amazon Web Services Taiwan Ltd (TW); Amazon Web Services, Inc. (US); AWS India ProServe LLP (IN); Elemental Technologies LLC (US); Souq.com for E-Commerce LLC (EG). Applicable service-specific list: https://aws.amazon.com/compliance/sub-processors/ (2026-07-28) Agreement reference: Existing supplier DPA confirmed by the operator. Standard contracting entity for a German account under the AWS Customer Agreement: https://aws.amazon.com/agreement/ ; DPA: https://aws.amazon.com/compliance/gdpr-center/ ; privacy contact: https://aws.amazon.com/privacy/ .

Contracting entity: OpenAI Ireland Ltd. Address: 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland Privacy contact: privacy@openai.com; dpo@openai.com Service and purpose: Product text AI and real-time voice processing for customer enquiries and appointment actions. Data and people: Submitted messages or audio, conversation context, contact and appointment information, and technical metadata. Data subjects include callers, contacts and participating users or employees. Condition of use: Only with QORLYNT AI or telephone assistance enabled and within the submitted content. Customer-owned AI connections are assessed separately. Processing locations: QORLYNT Production project: last observed residency Global; no active EU restriction verified. International processing, including the United States, is possible. Access countries: Global API operation: infrastructure locations per company below (ISO country codes); Cloudflare CDN worldwide near the user. Moderation: US, CA, PH; support/affiliates additionally IE, GB, JP and Salesforce support locations in the referenced list. No EU restriction or ZDR commitment. Transfer bases and safeguards: For EEA data, section 4.1 of the OpenAI DPA provides for onward transfers based on EU Standard Contractual Clauses or an applicable adequacy decision. This does not establish EU-only processing or Zero Data Retention. Further processing chain: API infrastructure: Microsoft Corporation (AU, BE, BR, CA, DK, FR, DE, IN, ID, IE, IT, JP, MY, MX, NL, NZ, NO, PL, SG, ZA, KR, ES, SE, CH, AE, GB, US); CoreWeave, Inc. (NO, ES, SE, GB, US); Oracle Cloud Infrastructure (BR, JP, MY, NL, GB, US); Google Cloud Platform (FI, JP, NL, NO, SG, GB, US); Amazon Web Services, Inc. (US); Cerebras (US, CA). CDN: Cloudflare, Ltd. (worldwide). Data platform: Snowflake, Inc. and Fivetran, Inc. (US). Flagged content for abuse review: Cinder Technologies, Inc. (US), TaskUs, LLC (PH), Accenture International Limited (US, CA, PH). Only for shared support data: Salesforce and the listed TaskUs/Accenture services. Affiliates: OpenAI, OpCo, LLC and OAI International, Inc. (US), OpenAI Ireland Ltd. (IE), OpenAI UK Ltd. (GB), OpenAI Japan Ltd. (JP). Premium support/Pylon only if separately used; API use alone does not include ChatGPT's WorkOS/Merge services. Product, location and use conditions: https://openai.com/policies/sub-processor-list/ (2026-10-14) Agreement reference: Existing supplier DPA confirmed by the operator. OpenAI DPA effective 1 January 2026; OpenAI Ireland Ltd. for EEA/Swiss customers: https://openai.com/policies/data-processing-addendum/ . Address/contacts: https://openai.com/policies/eu-services-privacy-policy/ .

Contracting entity: Twilio Ireland Limited Address: 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland Privacy contact: privacy@twilio.com Service and purpose: Provisioning and management of phone numbers and SIP/voice transmission for the QORLYNT telephone assistant. Data and people: Phone numbers, voice transmission, connection/call metadata and necessary business/representative/regulatory evidence. Data subjects include callers, customer contacts and representatives. Condition of use: Only with commissioned telephony. Assess Twilio's own statutory telecom, billing and security purposes separately according to the applicable controller role. Processing locations: QORLYNT telephony uses Twilio’s United States (US1) region for managed SIP/voice resources. Account administration, telecommunications delivery and support are distinct from this product region. Access countries: US1: United States. AWS/Clickhouse infrastructure listed in the USA/EU, AWS also Australia. Global telecommunications delivery depends on caller, destination and carriers. Support access is governed by the Twilio DPA; support personnel are not represented as restricted to US1 or the EU. Transfer bases and safeguards: Twilio DPA, Schedule 3: the Data Privacy Framework takes precedence for covered transfers, followed by applicable Binding Corporate Rules or EU Standard Contractual Clauses. Each mechanism applies only within its recipient and certification scope; no blanket EU-only commitment. Further processing chain: Core Voice/SIP: Twilio Inc. (US; service provision as subprocessor of the Irish contracting entity), AWS (US/EU/AU), Clickhouse (US/EU). Only for Twilio speech recognition/synthesis actually used: AWS, Deepgram, Google and VoiceBase (US). QORLYNT's own OpenAI voice integration does not automatically activate these products. Voice/SIP alone does not include SendGrid, Segment, Flex, Stytch or Conversational Intelligence. Twilio classifies telecommunications carriers separately. Full product allocation and regional exceptions: https://www.twilio.com/en-us/legal/sub-processors (2026-10-24) Agreement reference: Existing supplier DPA confirmed by the operator. Twilio's standard EEA terms name Twilio Ireland Limited: https://www.twilio.com/en-us/legal/tos . DPA: https://www.twilio.com/en-us/legal/data-protection-addendum ; contact: https://www.twilio.com/en-us/legal/privacy .

Contracting entity: Cloudflare, Inc. Address: 101 Townsend Street, San Francisco, CA 94107, USA Privacy contact: legal@cloudflare.com Service and purpose: Cloudflare Turnstile: protecting public forms against automated and abusive requests. Data and people: Technical connection/browser signals and verification results of form users. Condition of use: Production use confirmed by the operator. Include commissioned processing only; assess Cloudflare's own bot-detection purposes separately. Processing locations: Technical Turnstile verification signals are processed on Cloudflare’s global network; no exclusive European processing commitment. Access countries: Turnstile processes technical verification signals through Cloudflare's global network. Potential account/engineering support locations: AE, AU, CA, CH, DE, FR, GB, IN, JP, KR, MX, MY, NL, PT, SE, SG, US; Zendesk additionally EEA and Japan/Australia. No exclusive EU processing. Transfer bases and safeguards: Cloudflare DPA v6.4, section 6: covered international transfers use its transfer mechanisms including EU Standard Contractual Clauses; an applicable adequacy decision may apply under the DPA. No EU-only commitment. Further processing chain: Account/support services where data is shared accordingly: Slack Technologies, Inc. (US), Salesforce, Inc. (US), Zendesk, Inc. (US/EEA/JP/AU). Affiliate support: Cloudflare Ltd. (GB); Cloudflare Pte. Ltd. (SG); Cloudflare Australia Pty Ltd (AU); Cloudflare Germany GmbH (DE); Cloudflare Portugal, Unipessoal Lda. (PT); Cloudflare France SAS (FR); Cloudflare Japan K.K. (JP); Cloudflare (Canada) Information Technology Co., Ltd. (CA); Cloudflare Netherlands B.V. (NL); Cloudflare Middle East FZ-LLC (AE); Area 1 Security, LLC (US); Cloudflare Korea LLC (KR); Cloudflare Mexico, S. de R.L. de C.V. (MX); Cloudflare Malaysia Sdn. Bhd. (MY); Cloudflare Capability Center (India) Private Limited (IN); Cloudflare Sweden AB (SE); Cloudflare Switzerland GmbH (CH). Cloudflare India Private Limited is restricted to Indian customers. Workers AI, AI Gateway, Developer or Zero Trust suppliers do not automatically apply to Turnstile. Service-specific list: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/ (2025-10-01) Agreement reference: Cloudflare DPA v6.4, 3 April 2026: https://www.cloudflare.com/cloudflare-customer-dpa/ ; Turnstile roles: https://www.cloudflare.com/turnstile-privacy-policy/ .

Contracting entity: Microsoft Ireland Operations Limited Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland Privacy contact: https://www.microsoft.com/privacy/privacystatement Service and purpose: Microsoft 365/Exchange receives and stores QORLYNT business and support email, accessed through Outlook; Teams supports online setup assistance and support meetings. Data and people: Sender/recipient addresses, email content and attachments, support correspondence and meeting content; customer-commissioned data contained in support where necessary. Condition of use: Microsoft 365/Exchange mailbox hosting and Teams use confirmed by the operator; AWS domain management and automated QORLYNT delivery through SES are separate services. Include in the customer annex where commissioned customer data is processed; assess own contract/support administration separately. Do not assume recording or OneDrive use is confirmed. Processing locations: Exchange and Teams data are processed in the geography assigned to the Microsoft 365 tenant under the storage commitments in the Microsoft DPA and Product Terms. The actual tenant storage location has not been separately retrieved; no exclusive EU/Germany storage commitment is made. Global operational/support access is described separately below. Access countries: Possible Microsoft/contract-staff access locations under the worldwide list (ISO country codes; not an assertion of actual individual access): AE, AM, AO, AR, AT, AU, BA, BD, BE, BG, BH, BN, BO, BR, CA, CH, CI, CL, CN, CO, CR, CY, CZ, DE, DK, DO, DZ, EC, EE, EG, ES, FI, FR, GB, GE, GH, GR, GT, HK, HN, HR, HU, ID, IE, IL, IN, IS, IT, JM, JO, JP, KE, KR, KW, KZ, LB, LK, LT, LU, LV, MA, ME, MK, MO, MT, MU, MX, MY, NA, NG, NL, NO, NZ, OM, PA, PE, PH, PK, PL, PT, PY, QA, RO, RS, SA, SE, SG, SI, SK, SN, SV, TH, TN, TR, TT, TW, UA, US, UY, VN, ZA. https://learn.microsoft.com/en-us/microsoft-365/enterprise/personnel-loc/m365-personnel-location?view=o365-worldwide (2026-04-24) Transfer bases and safeguards: Microsoft Products and Services DPA incorporated into the Microsoft Customer Agreement; covered international transfers use the agreed EU Standard Contractual Clauses and applicable adequacy decisions where relevant. The EU Data Boundary does not mean that all international support/operational transfers are excluded. Further processing chain: Exchange/Teams: Akamai Technologies, Inc. (worldwide CDN); Scuba Analytics, Inc. (Teams analytics of pseudonymous data, US). Contract staff under Microsoft's control on Microsoft systems: Accenture International Limited; Akvelon, Inc.; Allegis Group Holdings, Inc.; Allyis, Inc.; Apex Systems, LLC; Aptly Technology Corporation; Beyondsoft Consulting, Inc.; Blueprint Technologies; Capgemini America, Inc.; Capgemini, España, S.L.; Centific Technologies, Inc.; Cognizant Technology Solutions; CSI Interfusion, Inc.; DXC Technology Services LLC; Ernst & Young, LLP; Experis; HCL America, Inc.; Hi-Tech Talents LLC; Infosys Limited; Insight Global, Inc.; Latentview Analytics Corporation; Launch Consulting; LTIMindtree Limited; Maq LLC; Matchpoint IT Ltd.; Mu Sigma Business Solutions, LLC; Shanghai Wicresoft Co., Ltd.; Sonata Software Limited; Tata Consultancy Services Ltd.; Tek Experts; Teleion Consulting, LLC; Telus International AI, Inc.; Valorem, LLC; Wicloud Corporation; Wipro Limited. See the separate field for personnel access locations; a company's headquarters does not establish access location. Infrastructure entities depend on the region used (e.g. Microsoft Deutschland MCIO GmbH/DE, Microsoft Ireland Operations Limited and Microsoft RL Unlimited Company/IE, Microsoft Datacenter Netherlands B.V./NL, Microsoft Sweden 1172 AB/SE, Microsoft Corporation/US). Full infrastructure and staffing tables: https://servicetrust.microsoft.com/ViewPage/DocumentPreview?documentId=115f1cb5-7f7b-4a5e-838d-df6d03c84dda (2026-09-10). Suppliers allocated solely to other Azure products and uncommissioned AI/Copilot features are not represented as active Exchange/Teams processing. Agreement reference: Account screenshot confirms Microsoft Customer Agreement (MCA); the displayed opening incorporates the DPA. Entity/address from the official German MCA standard sample: https://www.microsoft.com/licensing/docs/documents/download/MCASample_Germany_March2023_de-de.docx . DPA: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA . The contracting allocation is based on the confirmed standard MCA.