Data Processing Agreement

Personal Data Processing Agreement

This Personal Data Processing Agreement (the “Agreement”) is the data processing agreement referred to in Section 11 of the Public Offer Agreement. It forms part of the agreement between Partix LLC, a limited liability company registered in Georgia (identification number 405857853), and the Client, and applies automatically from the moment Partix processes Client Personal Data on the Client’s behalf, where a data processing agreement is required by applicable law or requested by the Client.

Capitalized terms not defined in this Agreement have the meaning given in the Offer. This Agreement should be read together with the Partix Privacy Policy.

1. Scope and Roles

Partix LLC (the “Processor”) processes personal data on behalf of the Client (the “Controller”) only to the extent this occurs in the course of providing the Services under the Offer or an Order (“Client Personal Data”). This Agreement does not apply to personal data that Partix collects and uses for its own purposes as an independent controller — for example, website visitors and business contacts who submit inquiries through partix.llc; that processing is described in the Partix Privacy Policy.

The Client decides the purposes and means of processing Client Personal Data. The Processor processes Client Personal Data only to provide the Services and strictly on the Client’s instructions as set out in this Agreement.

2. Legal Framework

Partix LLC is a limited liability company registered in Georgia. The processing of Client Personal Data under this Agreement is governed primarily by the Law of Georgia on Personal Data Protection (as amended, effective in its current form since 1 March 2024), which is enforced by the Personal Data Protection Service of Georgia and is substantially modelled on the EU General Data Protection Regulation (GDPR).

Where Client Personal Data is also subject to the GDPR, the UK GDPR, the Swiss FADP, or another data protection law applicable to the Client or its data subjects, the Parties will additionally comply with the requirements of that law that apply to their respective roles, and Sections 9 and 11 of this Agreement apply accordingly.

3. Description of Processing

4. Processor Obligations

The Processor will:

• process Client Personal Data only on the Client’s documented instructions, which consist of this Agreement, the applicable Order and the Client’s ordinary use of the Services, unless applicable law requires otherwise (in which case the Processor will inform the Client of that legal requirement before processing, unless the law prohibits such notice);
• promptly inform the Client if, in its reasonable opinion, an instruction given by the Client infringes the Law of Georgia on Personal Data Protection, the GDPR, or another applicable data protection law;
• not sell Client Personal Data, and not use it for the Processor’s own marketing or for any purpose outside the scope of the Services;
• ensure that personnel authorized to process Client Personal Data are subject to an appropriate duty of confidentiality, whether contractual or statutory.

5. Client Obligations

The Client is responsible for having a lawful basis, and for providing all notices and obtaining all consents, necessary to submit Client Personal Data to the Processor under the Law of Georgia on Personal Data Protection and any other applicable law. The Client is responsible for the accuracy of the Client Personal Data it submits and for not submitting special categories of data without the Processor’s prior written agreement. The Client remains responsible for fulfilling its own obligations as a controller towards data subjects and the Personal Data Protection Service of Georgia or any other competent regulator.

6. Technical and Organizational Measures

The Processor maintains commercially reasonable measures appropriate to the risk, including:

• access controls, least-privilege access and authentication for credentials, servers, databases and APIs;
• encryption of Client Personal Data in transit and, where appropriate, at rest;
• logging, monitoring and vulnerability management for the systems used to provide the Services;
• regular backups and documented incident-response procedures;
• due-diligence review of hosting and infrastructure providers used to deliver the Services.

No system is completely secure. The Client remains responsible for protecting its own credentials, systems and integrations with the Services.

7. Use of Sub-processors

The Client gives general authorization for the Processor to engage sub-processors such as hosting, cloud infrastructure, email, support and payment providers reasonably necessary to deliver the Services. The Processor will impose on each sub-processor data-protection obligations no less protective than those set out in this Agreement and remains responsible for the sub-processor’s performance of those obligations.

The Processor will provide the current list of sub-processors on the Client’s written request and will give the Client reasonable prior notice of any new sub-processor. The Client may object on reasonable data-protection grounds within fourteen (14) days of such notice; if the Parties cannot agree on a solution, the Client may discontinue use of the affected Services without further liability for the unused portion.

8. Data Subject Requests

The Processor will promptly forward to the Client any request it receives from an individual concerning Client Personal Data, and will not itself respond to such a request other than to redirect the individual to the Client, unless the Client instructs otherwise in writing. The Processor will provide the Client with reasonable assistance so that the Client can respond to data subject requests under the Law of Georgia on Personal Data Protection or other applicable law within the statutory time limits. Assistance going beyond what is reasonably included in the standard Services may be charged at the Processor’s then-current rates.

9. International Data Transfers

The Processor is established and primarily operates from Georgia. Outbound transfers of Client Personal Data from Georgia to another country — including transfers to sub-processors located outside Georgia — are made only to countries recognized as providing an adequate level of data protection, or subject to appropriate safeguards, in accordance with the Law of Georgia on Personal Data Protection.

Georgia has not been the subject of an adequacy decision issued by the European Commission under the GDPR. Accordingly, where Client Personal Data subject to the GDPR, the UK GDPR or the Swiss FADP is transferred to the Processor in Georgia or onward to a sub-processor in a country without an applicable adequacy decision, the Parties agree that the EU Standard Contractual Clauses (Module Two, Controller to Processor, or Module Three, Processor to Processor, where applicable), and, where relevant, the UK International Data Transfer Addendum, are incorporated into this Agreement by reference and take effect automatically with respect to the relevant transfer, without the need for a further signature, unless the Parties agree on an alternative transfer mechanism in writing.

10. Security Incident Notification

The Processor will notify the Client without undue delay, and where feasible within seventy-two (72) hours, after becoming aware of a confirmed personal data breach affecting Client Personal Data, and will provide the information reasonably available to it about the nature of the breach, its likely consequences and the measures taken or proposed to address it. As the data controller, the Client is responsible for deciding on and carrying out any notification to data subjects, the Personal Data Protection Service of Georgia, or other regulators required by applicable law.

11. Assistance and Audits

The Processor will provide information reasonably necessary to demonstrate compliance with this Agreement and will provide reasonable assistance with data protection impact assessments and consultations with the Personal Data Protection Service of Georgia or another competent authority, where required by law. The Client may audit the Processor’s compliance with this Agreement once every twelve (12) months, on at least thirty (30) days’ written notice, during the Processor’s normal business hours, at the Client’s own cost and subject to confidentiality obligations. The Processor may satisfy a request for audit information by providing recent third-party security reports, certifications or written answers to a reasonable security questionnaire, where doing so provides materially the same assurance.

12. Return and Deletion

When the applicable Order or paid access period ends, the Processor will, upon the Client’s written request made within thirty (30) days of the end date, return or delete the Client Personal Data in its possession. If no such request is made, the Processor may delete the Client Personal Data after a reasonable retention period. Data contained in routine backups is removed in the ordinary backup-rotation cycle rather than on demand, and the Processor may retain Client Personal Data to the extent required by applicable law or for legitimate security, accounting, audit or dispute-resolution purposes.

13. Liability, Governing Law and Precedence

Each Party’s liability under this Agreement is subject to the limitations set out in Section 13 of the Public Offer Agreement. This Agreement is governed by the laws of Georgia and disputes are resolved as provided in Section 17 of the Offer. If this Agreement conflicts with the Offer regarding the processing of Client Personal Data, this Agreement prevails; if the EU Standard Contractual Clauses apply under Section 9, they prevail over this Agreement to the extent of any conflict.

14. Contact

For questions or requests under this Agreement, contact: