Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of Walter's Customer Terms and Conditions (the "Terms") and of any other agreement between Walter and Customer that incorporates it. It adds to section 18 of the Terms the provisions data protection law requires of a processor, and does not repeat what the Terms already say: the parties' roles, confidentiality, security incidents, subprocessors, and the return and deletion of data are governed by the Terms as supplemented here.

Capitalised terms not defined in this DPA have the meaning given in the Terms. Where this DPA conflicts with the Terms as regards Customer Personal Data, this DPA prevails.

"Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other US state privacy laws, and any other law that applies to the processing of Customer Personal Data.

"Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR, or the equivalent terms in other Data Protection Law.

"Restricted Transfer" means a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country that does not benefit from an adequacy decision.

"SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, and "UK Addendum" means the International Data Transfer Addendum to them issued by the UK Information Commissioner.

2.1 The details of the processing — its subject matter, nature, purpose and duration, and the categories of personal data and data subjects — are set out in Annex I.

2.2 Where Customer is itself a processor acting for a third-party controller, Customer warrants that its instructions are authorised by that controller, and Walter acts as Customer's subprocessor.

2.3 Where the law requires Walter to process Customer Personal Data other than on Customer's instructions, Walter will tell Customer before doing so unless the law prohibits it. Walter will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

2.4 Walter does not use Customer Personal Data to train AI models, and the AI providers on its subprocessor list process it under terms that prohibit them from doing so.

3.1 Security measures. The measures Walter maintains under section 18(e) of the Terms are described in Annex II. Walter may update them provided the overall level of protection is not reduced.

3.2 Data subject requests. Taking into account the nature of the processing, Walter assists Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. Walter will forward to Customer any such request it receives directly and will not respond to it except on Customer's instructions or as the law requires.

3.3 Impact assessments. Walter provides reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Walter.

4.1 Walter gives the notice required by section 18(f) of the Terms within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data.

4.2 The notice describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Walter provides further information as it becomes available and takes reasonable steps to contain and remedy the breach.

Deletion under section 18(j) of the Terms extends to backups as they expire on their normal cycle. Customer Personal Data held in a backup is not restored in the meantime, except where the law requires it.

6.1 The subprocessors Customer authorises under section 18(h) of the Terms are those on the list published at wearewalter.com/legal/subprocessors.

6.2 Walter gives notice of a new or replacement subprocessor at least 30 days before it begins processing Customer Personal Data, by email to Customer's account contacts or in the Walter platform. Customer may object within that period.

7.1 Walter stores and processes Customer Personal Data in the European Economic Area, except where a subprocessor on the list in clause 6.1 processes it elsewhere.

7.2 For a Restricted Transfer subject to the GDPR, the SCCs are incorporated into this DPA. Module Two applies where Customer is a controller and Module Three where Customer is a processor. Customer is the data exporter and Walter the data importer; the docking clause in Clause 7 applies; Option 2 of Clause 9(a) applies, with the notice period in clause 6.2; the optional language in Clause 11(a) does not apply; Clause 17 is governed by the law of Spain and the courts of Spain are chosen under Clause 18; the competent supervisory authority is the one determined under Clause 13, and otherwise the Agencia Española de Protección de Datos; and Annexes I and II of the SCCs are completed by Annexes I and II of this DPA.

7.3 For a Restricted Transfer subject to the UK GDPR, the UK Addendum is incorporated into this DPA, with its tables completed by the information in this DPA and the SCCs. For a Restricted Transfer subject to the FADP, the SCCs apply with references to the GDPR read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

7.4 Where the recipient is certified under the EU–US Data Privacy Framework or one of its UK or Swiss extensions, Walter may rely on that certification instead.

7.5 Where this DPA conflicts with the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail.

Where the CCPA or another US state privacy law applies, Walter is a service provider or processor for Customer Personal Data and will not: (a) sell or share it; (b) retain, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship between Walter and Customer; or (c) combine it with personal data Walter receives from others, except as the law permits. Walter will give it the level of protection the law requires, tell Customer if it can no longer meet these obligations, and allow Customer to take reasonable steps to stop and remedy any unauthorised use. Walter understands and will comply with these restrictions.

9.1 Walter makes available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and, once obtained, third-party certifications and audit reports.

9.2 Where that information is not sufficient to demonstrate compliance, Customer may, no more than once a year and on at least 30 days' written notice, conduct an audit itself or through an independent auditor bound by confidentiality, during business hours and in a way that does not unreasonably disrupt Walter's operations. Each party bears its own costs.

• Hosting: all customer data stored and processed in Google Cloud, europe-west1 (Belgium). Google Cloud is certified to ISO/IEC 27001, 27017 and 27018 and holds SOC 1, 2 and 3 attestations.
• Encryption: TLS in transit; AES-256 at rest for databases, backups and stored documents.
• Network: a single public entry point through a load balancer protected by a web application firewall; application services accept traffic only from that load balancer; internal tools behind Identity-Aware Proxy.
• Access control: least privilege; named staff only; Google Workspace accounts with multi-factor authentication; short-lived identity-based database credentials with no static passwords; secrets held in a managed secret store.
• Customer separation: every query in the platform is scoped to the customer's account and enforced by row-level security in the database.
• Logging and monitoring: every request logged and retained; daily automated analysis of traffic for attack patterns; cloud audit logs for administrative activity.
• Vulnerability management: continuous scanning of deployed container images and dependency alerting on source repositories, with findings patched by severity.
• Change management: peer-reviewed pull requests, automated checks, and a named approval for every production release.
• Environment separation: production and non-production separated; test data anonymised before use.
• Availability: daily automated database backups with point-in-time recovery, retained within the EU.
• Incident response: a documented incident process, with notification to affected customers as set out in clause 4.