Data Processing Agreement

Last updated: June 22, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Use between Customer and Meiotic Inc. (operating as Yonderly) under which the Processor provides the Controller with the software and services (the "Services"). The Controller and the Processor are individually referred to as a "Party" and collectively as the "Parties".

The Parties seek to implement this DPA to comply with the requirements of EU GDPR in relation to Processor's processing of Personal Data. Except as modified below, the terms of the Agreement shall remain in full force and effect.

Definitions

• Data Transfer means a transfer of Personal Data from the Controller to the Processor, or with a Sub-processor.
• EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• Standard Contractual Clauses means the clauses pursuant to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021.
• Controller means the person or body which determines the purposes and means of the processing of personal data.
• Processor means a person or body which processes personal data on behalf of the controller.
• Sub-processor means a processor appointed by the Processor for the provision of all or parts of the Services.

Purpose of this Agreement

This DPA sets out the obligations of the Processor in relation to the Processing of Personal Data. If there is a conflict between the provisions of the Agreement and this DPA, the provisions of this DPA shall prevail.

Categories of Personal Data and Data Subjects

The Controller authorizes the Processor to process Personal Data to the extent determined and regulated by the Controller.

Purpose of Processing

The objective of Processing of Personal Data by the Processor shall be limited to the Processor's provision of the Services to the Controller pursuant to the Agreement.

Duration of Processing

The Processor will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.

Data Controller's Obligations

The Data Controller shall warrant that it has all necessary rights to provide Personal Data to the Data Processor, that any necessary Data Subject consents are obtained and recorded, and that revocation of consent is communicated promptly to the Data Processor. The Data Controller shall provide all natural persons from whom it collects Personal Data with the relevant privacy notice.

Data Processor's Obligations

The Processor will follow written and documented instructions received from the Controller with respect to the Processing of Personal Data, and will provide reasonable assistance to the Controller in responding to requests from Data Subjects or applicable regulatory authorities. Where Personal Data is transferred outside the Data Processor's territorial boundaries, the transferor shall ensure the recipient is under contractual obligations to protect such data to the same or higher standards.

Data Secrecy

The Processor will use personnel who are informed of the confidential nature of the Personal Data, will regularly train individuals having access to Personal Data in data security and privacy, and shall maintain appropriate technical and organizational measures for protection of the security, confidentiality, and integrity of Personal Data.

Audit Rights

Upon Controller's reasonable request, the Processor will make available information necessary to demonstrate compliance with EU GDPR obligations. The Controller shall provide at least thirty (30) days prior written notice before conducting an audit and shall bear the expense of such audit.

Mechanism of Data Transfers

Any Data Transfer for Processing in a country outside the European Economic Area shall only take place in compliance with required security laws and applicable Standard Contractual Clauses.

Sub-processors

The Processor may engage third-party Sub-processors provided they take appropriate measures to ensure confidentiality of Personal Data. Current Sub-processors include:

• Atlassian, Software development tools, US Data Centers, San Francisco, CA
• Brevo / Sendinblue, Email delivery, EU Data Centers
• Microsoft Corporation (Azure), Cloud services, US East and Global Data Centers
• SiteGround, Web hosting, US and EU Data Centers
• Google LLC, Fonts and Analytics, US Data Centers, Mountain View, CA

Personal Data Breach Notification

The Processor shall without undue delay notify the Controller if it becomes aware of any Personal Data Breach unless such breach is unlikely to result in a risk to the rights and freedoms of natural persons. Notification of a breach will not be construed as an acknowledgement of fault or liability.

Return and Deletion of Personal Data

Within thirty (30) days from the end of the Agreement, the Processor shall return or delete all Personal Data as instructed by the Controller, and shall delete all copies as soon as reasonably practicable.

Technical and Organizational Measures

The Processor will take appropriate technical and organizational measures against unauthorized or unlawful processing of Personal Data and against accidental loss, destruction, or damage, to ensure a level of security appropriate to the nature of the data and the harm that might result.

Contact