Data processing addendum

1. Roles and scope

For Customer Data processed to provide the Service, Customer is the controller, business, data fiduciary, or equivalent and Autobahn is the processor, service provider, data processor, or equivalent, unless applicable law or the parties’ documented processing makes another allocation necessary. Autobahn may be an independent controller for account, billing, security, support, fraud-prevention, and product-operations processing described in the Privacy Notice.

This addendum applies to personal data submitted to the Service under an applicable order form or subscription. The processing details—data subjects, data categories, sensitive-data restrictions, duration, purposes, instructions, locations, and retention—must be completed in a schedule before signature.

2. Instructions and confidentiality

Autobahn will process Customer Data only on Customer’s documented instructions, including to provide the Service, maintain security, support Authorized Users, comply with the agreement, and follow a lawful written instruction. Autobahn will inform Customer if it believes an instruction violates applicable data-protection law, unless prohibited from doing so.

People authorized to process Customer Data must be bound by confidentiality obligations. Customer is responsible for the lawfulness of its instructions, notices, permissions, consent records, and configuration of the Service.

3. Security and incidents

Autobahn will maintain technical and organizational safeguards appropriate to the risk, including access control, authentication, confidentiality, encryption in transit, resilience, restoration, testing, and incident response as documented in the final security exhibit. Autobahn will notify Customer without undue delay after confirming a personal-data breach affecting Customer Data and will provide available information needed for Customer’s assessment and notices.

The parties must agree on the notification channel, response contacts, cooperation standard, evidence preservation, and any customer-specific incident deadline. The website’s general Privacy Notice is not a substitute for this operational commitment.

4. Subprocessors

Customer authorizes the subprocessors listed in the final subprocessor schedule to process Customer Data for the stated services. Autobahn will impose written data-protection obligations appropriate to the processing and remains responsible for its subprocessors’ performance to the extent required by applicable law. The final schedule must state the notice and objection process for new subprocessors.

5. Requests, assessments, and audits

Taking into account the nature of processing, Autobahn will provide reasonable assistance with data-subject requests, security assessments, breach investigations, impact assessments, regulator consultations, and legally required records. Customer must first use available product controls and provide the information needed to identify the relevant data and instruction.

Audit rights, scope, frequency, confidentiality, cost allocation, and independent assurance reports must be completed in the final schedule. No audit right authorizes access to another customer’s data, source code, or security-sensitive information.

6. International transfers

The final DPA will identify the transfer locations, exporter/importer roles, and lawful safeguard for each relevant jurisdiction. For EEA transfers, the parties should select the applicable EU Standard Contractual Clauses module or other lawful mechanism. Türkiye, India, the United Arab Emirates, DIFC, ADGM, and United Kingdom requirements must be assessed separately rather than assumed to accept the same instrument.

7. Return and deletion

At Customer’s choice and subject to the agreement, Autobahn will return or delete Customer Data after the Service ends, unless retention is required by law. Backup copies may remain protected until overwritten under the documented backup cycle. The final schedule must state the export format, retrieval window, deletion target, and legal-retention exceptions.

8. Precedence and local modules

If this addendum conflicts with the Terms on data processing, this addendum controls. Mandatory local law controls where it cannot be waived by contract. The parties should attach regional modules for the EEA/UK, Türkiye, India, UAE mainland, DIFC, ADGM, and any other market in which Customer Data will be processed.