Data Processing Addendum

History:

• Data Processing Addendum (before 24.11.2025)

This Data Processing Addendum ("DPA") forms a part of the Customer Terms of Service found at https://fibery.io/terms-of-service - unless the Customer has entered into a superseding written master agreement with Fibery Limited ("Fibery"), in which case, it forms a part of such written agreement (in either case, the "Agreement"). By signing the DPA, the Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws, in the name and on behalf of its Controller Affiliates (defined below). For the purposes of this DPA only, and except where indicated otherwise, the term "Customer" shall include Customer Affiliates. All capitalized terms not defined herein shall have the meaning set forth in the Agreement. In the course of providing the Services under the Agreement, Fibery may Process certain Personal Data (such terms defined below) on behalf of the Customer, and where Fibery Processes such Personal Data on behalf of the Customer, the Parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data. The Parties agree that in the event of any conflict between the Agreement and this Addendum, the provisions of this Addendum shall control.

1. Subject Matter and Duration

1.1. Applicability

This Addendum will not apply to the processing of Customer Personal Data where such processing is not regulated by EU Data Protection Laws. If Data Protection Laws outside the European Economic Area, Switzerland, or the United Kingdom apply to either Party's processing of Customer Personal Data, the Parties acknowledge and agree that the relevant Party will comply with any obligations applicable to it under those laws with respect to such processing.

1.2. How to execute this DPA

1. This DPA consists of the main body of the DPA and Exhibits A–D.
2. This DPA has been pre-signed on behalf of Fibery.
3. The Standard Contractual Clauses might be signed where necessary and have been pre-signed by Fibery as the data importer.
4. Customer has two options to complete this DPA:
   • Complete the information in the signature box and sign on the designated page, then send completed and signed DPA to Fibery by email indicating Customer's account URL(s) via gdpr@fibery.io. Upon receipt of the validly completed DPA by Fibery at this email address, this DPA will become legally binding.
   • Provide corresponding consent when signing up for the Service

NOW, THEREFORE, in consideration of the mutual agreements set forth in this document and for other good and valuable consideration, the receipt and sufficiency of which the Parties both acknowledge, the Parties agree as follows:

1.3. Definitions

Capitalized terms used but not defined in this DPA have the meanings given elsewhere in the applicable Agreement. In this DPA, unless stated otherwise:

"Additional Products" means products, services and applications that are not part of the Services but that may be accessible via user interface or otherwise, for use with the Services.

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control," for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

"Amendment Effective Date" means the date on which Customer clicked to accept or the parties otherwise agreed to this DPA in respect of the applicable Agreement.

"Controller" means the entity which determines the purposes and means of the Processing of Personal Data.

"Controller Affiliate" means any of Customer's Affiliate(s)

1. (i) that are subject to applicable Data Protection Laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom, and (ii) permitted to use the Services pursuant to the Agreement between Customer and Fibery, but have not signed their own Order Form and are not a "Customer" as defined under the Agreement,
2. if and to the extent Fibery processes Personal Data for which such Affiliate(s) qualify as the Controller.

"Customer Personal Data" means personal data contained within the Customer Data.

"Data Protection Laws" means all laws and regulations, including laws and binding regulations of the European Union, the European Economic Area and their member states, Switzerland and the United Kingdom, applicable to the Processing of Personal Data under the Agreement.

"Data Subject" means the identified or identifiable person to whom Personal Data relates.

"EU Data Protection Laws" means all laws and regulations of the European Union, the European Economic Area, their member states, and the United Kingdom, applicable to the processing of Personal Data under the Agreement, including (where applicable) the GDPR;

"GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

"Data Protection Officer (DPO)" means the individual appointed by Fibery under Article 37 GDPR, contactable at gdpr@fibery.io.

"Personal Data" means any Customer Data that relates to an identified or identifiable natural person, to the extent that such information is protected as personal data under applicable Data Protection Laws.

"Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor" means the entity which Processes Personal Data on behalf of the Controller.

"Security, Privacy and Architecture Documentation" means Fibery's documentation describing its technical and organizational security measures, as updated from time to time and made available to Customer upon request or via the Service.

"Standard Contractual Clauses" means the standard data-protection clauses adopted by the European Commission under Decision (EU) 2021/914 of 4 June 2021 (Module Two – Controller to Processor), as reproduced in Exhibit D of this DPA. These Clauses are incorporated by reference and form part of this DPA. Where required under applicable Data-Protection Laws, the Parties shall execute or otherwise be deemed to have executed the Standard Contractual Clauses, which have been pre-signed by Fibery Ltd as the data importer.

"Sub-Processor" means any entity engaged by Fibery or its affiliates to Process Personal Data in connection with the Services.

"Supervisory Authority" means an independent public authority which is established by an EU Member State pursuant to the GDPR.

"Term" means the period from the Amendment Effective Date until the end of Fibery's provision of the Services under the applicable Agreement, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Fibery may continue providing the Services for transitional purposes.

The terms "personal data", "data subject", "processing", "controller", "processor" and "supervisory authority" as used in this DPA have the meanings given in the GDPR, and the terms "data importer" and "data exporter" have the meanings given in the Standard Contractual Clauses, in each case irrespective of whether EU Data Protection Laws or other Data Protection Laws apply.

2. Processing of Personal Data

2.1 Roles of the Parties.

The Parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Fibery is the Processor and that Fibery or its Affiliates will engage Sub-Processors pursuant to the requirements set forth in Section 4 below. List of sub-processors is provided in Exhibit B.

2.1.1. Authorization by Third Party Controller.

If the EU Data Protection Laws apply to the processing of Customer Personal Data and Customer is a processor, Customer warrants to Fibery that Customer's instructions and actions with respect to that Customer Personal Data, including its appointment of Fibery as another processor, have been authorized by the relevant Controller.

2.2 Customer's Processing of Personal Data.

Customer shall, in its use of the Services and provision of instructions, Process Personal Data in accordance with the requirements of applicable Data Protection Laws. For the avoidance of doubt, Customer's instructions for the Processing of Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data, and the means by which Customer acquired Personal Data.

2.3 Fibery Processing of Personal Data.

As the Customer's Processor, Fibery shall only Process Personal Data for the following purposes:

1. Processing in accordance with the Agreement;
2. Processing initiated by Authorized Users in their use of the Services; and
3. Processing to comply with other reasonable instructions provided by Customer (e.g., via email or support tickets) that are consistent with the terms of the Agreement

(individually and collectively, the "Purpose").

Fibery acts on behalf of and on the instructions of the Customer in carrying out the Purpose. Fibery does not use Customer Personal Data for training or improving machine-learning models unless expressly authorized in writing by the Customer. AI-related Sub-Processors process only pseudonymized or non-personal data and do not receive Customer end-user authentication credentials or direct database access.

2.4 Details of the Processing.

The subject-matter of Processing of Personal Data by Fibery is as described in the Purpose in Section 2.3. The nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Exhibit A (Description of Processing Activities) to this DPA.

2.5 Duration of DPA.

This DPA will take effect on the Amendment Effective Date and, notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by Fibery as described in this DPA.

3. Rights of Data Subjects

3.1 Data Subject Requests.

Fibery shall, to the extent legally permitted, promptly notify Customer if Fibery receives any request from a Data Subject to exercise the following rights in relation to Personal Data: access, rectification, restriction of Processing, erasure ("right to be forgotten"), data portability, objection to Processing, or the right not to be subject to automated individual decision-making (each, a "Data Subject Request"). Taking into account the nature of the Processing, Fibery shall assist Customer by appropriate technical and organizational measures, insofar as possible, to enable Customer to fulfil its obligations to respond to such Data Subject Requests under applicable Data Protection Laws. To the extent the Customer, in its use of the Services, does not have the technical ability to address a Data Subject Request, Fibery shall, upon Customer's request, provide commercially reasonable assistance to support Customer's response, to the extent Fibery is legally permitted to do so and such response is required under applicable Data Protection Laws. Fibery will provide such standard assistance through the existing functionality of the Services at no additional charge. Where the Customer requests assistance that is extraordinary, highly resource-intensive, or requires custom or non-standard work, Fibery may charge the Customer reasonable fees for such assistance, provided that (i) such work is not required due to any breach or security incident caused by Fibery, and (ii) the Customer has approved such fees in writing in advance.

3.2 Access, Rectification and Restriction through the Service.

Fibery will, in a manner consistent with the functionality of the Service or per request, enable Customer to access, rectify, and restrict processing of Customer Personal Data.

3.3 Fibery's Processing Commitments.

With respect to the Personal Data under this DPA, Fibery warrants that it will:

1. only process Personal Data in order to provide the Service, and shall only act in accordance with: (i) this DPA, (ii) the Customer's written instructions as represented by the Agreement and this DPA, and (iii) as required by applicable laws;
2. upon becoming aware, inform the Customer if, in Fibery's opinion, any instructions provided by the Customer infringe Data Protection Laws or GDPR. In this case, Fibery shall have the right to refuse to execute the infringing instruction.

4. Sub-Processors

4.1 Appointment of Sub-processors.

Customer acknowledges and agrees that:

1. Fibery Affiliates may be retained as Sub-processors through written agreement with Fibery.
2. Fibery and Fibery Affiliates respectively may engage third-party Sub-Processors in connection with the provision of the Services. As a condition to permitting a third-party Sub-processor to Process Personal Data, Fibery or a Fibery Affiliate will enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Personal Data as those in this DPA, to the extent applicable to the nature of the Services provided by such Sub-Processor.

In either case, Customer agrees to enter into the Standard Contractual Clauses where necessary and acknowledges that Sub-processors may be appointed by Fibery in accordance with Clause 11 of the Standard Contractual Clauses.

4.2 List of Current Sub-processors and Notification of New Sub-processors.

A current and continuously updated list of Sub-Processors engaged by Fibery for the Services, including their identities, purposes of processing, and locations, is maintained online at: Sub-Processor List. Fibery will update this Sub-Processor List whenever a new Sub-Processor is engaged or an existing one is replaced, and will provide notice to Customer (for example, by email or through the Service interface) before the new Sub-Processor begins processing Customer Personal Data.

4.3 Objection Right for New Sub-Processors.

Customer may reasonably object to Fibery using a new Sub-processor (e.g., if making Personal Data available to the Sub-processor may violate applicable Data Protection Law or weaken the protections for such Personal Data) by notifying Fibery promptly in writing within ten (10) business days after receipt of Fibery notice in accordance with the mechanism set out in Section 4.2. Such notice shall explain the reasonable grounds for the objection. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, Fibery will use commercially reasonable efforts to make available to Customer a change in the Service or recommend a commercially reasonable change to Customer's configuration or use of the Services to avoid Processing of Personal Data by the objected new Sub-processor without unreasonably burdening Customer. If Fibery is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, either party may terminate without penalty the applicable Service which cannot be provided by Fibery without the use of the objected new Customer any prepaid fees covering the remainder of the term of Service following the effective date of termination, without imposing a penalty for such termination on the Customer.

4.4 Liability.

Fibery shall be liable for the acts and omissions of its Sub-Processors to the same extent Fibery would be liable if performing the Services of each Sub-Processor directly under the terms of this DPA.

5. Data Protection Impact Assessment

Upon Customer request, Fibery shall provide Customer with reasonable cooperation and assistance needed to fulfill Customer's obligation under the GDPR to carry out a data protection impact assessment related to Customer use of the Service, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Fibery. Fibery will provide reasonable standard assistance and existing documentation for such assessments at no additional charge as part of its ordinary compliance support. Where the Customer requests assistance that is extraordinary, highly resource-intensive, or requires the creation of custom or non-standard documentation or the engagement of external resources, Fibery may charge the Customer reasonable fees for such work, provided that (i) such assistance is not required as a result of any breach or security incident caused by Fibery, and (ii) the Customer has approved those fees in writing in advance. Fibery shall provide, upon reasonable request, all necessary documentation (e.g., penetration testing results, technical design descriptions, and security certifications) to support Customer's Data Protection Impact Assessments and Transfer Impact Assessments.

6. Data Deletion and Return.

6.1 Deletion on Service Expiry.

Subject to Section 6.2 (Deferred Deletion), on expiry of the applicable Service, Customer instructs Fibery to delete all Customer Data (including existing copies) from Fibery systems in accordance with applicable law. Fibery will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless EU or EU Member State law requires storage of this Customer Data. Without prejudice to Section 9.1 (Access; Rectification; Restricted Processing; Portability), Customer acknowledges and agrees that Customer will be responsible for exporting, before the applicable Service expires, any Customer Data it wishes to retain afterwards.

6.2 Deferred Deletion.

To the extent any Customer Data covered by the deletion instruction described in Section 6.1 (Deletion on Service Expiry) is also processed, when the applicable Service under Section 6.1 expires, in relation to an Agreement with a continuing Service, such a deletion instruction will only take effect with respect to such Customer Data when the continuing Service expires. For clarity, this DPA will continue to apply to such Customer Data until its deletion by Fibery.

6.3 Return of Customer Data.

Upon expiration of the Term as well as during the Term of the Agreement, Fibery will provide Customer with access to export Customer Personal Data from the Service.

7. Data Transfers

7.1 Data Storage and Processing Facilities

Customer acknowledges that Fibery Ltd is established within the European Union (Cyprus). For customers based in the EEA (others upon request), Fibery stores Service Data in Amazon Web Services (AWS) EU-Central (Frankfurt, Germany). Fibery may store limited identifying information about a Customer's instance (such as organization ID and configuration metadata) in other AWS regions for operational purposes; such metadata never includes end-user content. Details of hosting and Sub-Processors are set out in Exhibit B.

7.2 Transfer Mechanisms.

1. Scope. Cross-border data transfers under this DPA primarily concern onward transfers by Fibery or its affiliates to Sub-Processors located outside the EEA, including the United States.
2. Legal Basis for Transfers. To the extent any transfer of Customer Personal Data involves a destination country that does not ensure an adequate level of protection within the meaning of Article 45 GDPR, Fibery shall ensure that such transfer is governed by an appropriate safeguard under Chapter V GDPR, including:
   1. the EU Standard Contractual Clauses (Controller → Processor, Module Two), as reproduced in Exhibit D of this DPA;
   2. the EU Standard Contractual Clauses (Processor → Processor, Module Three) concluded between Fibery Ltd and its non-EEA Sub-Processors; or
   3. another lawful transfer mechanism under Article 46 GDPR (for example, participation in the EU-US Data Privacy Framework, where applicable).
3. Execution and Incorporation. The Standard Contractual Clauses attached as Exhibit D are incorporated by reference and form an integral part of this DPA. Where required under applicable Data-Protection Laws, the Parties shall be deemed to have executed those Clauses, which have been pre-signed by Fibery Ltd as the Data Importer.
4. Customer Co-operation. Where reasonably requested by Fibery to maintain compliance with applicable Data-Transfer Laws, the Customer agrees to execute or otherwise confirm the application of the Standard Contractual Clauses or successor mechanisms.

8. Personal Data Breach

8.1 Notification of Data Breach.

Fibery shall, to the extent permitted by law, notify Customer without undue delay and, where feasible, not later than 72 hours after Fibery or any Sub-Processor becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information, to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

8.2 Assistance to Client.

Fibery shall cooperate with the Customer and take reasonable commercial steps to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

9. Security

9.1 Controls for the Protection of Customer Data

Fibery shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Data), confidentiality, and integrity of Customer Data, as set forth in the Security, Privacy and Architecture Documentation. Fibery regularly monitors compliance with these measures and will provide the Customer with supporting documentation, such as audit information, where applicable. Fibery will not materially decrease the overall security of the Service during a Service subscription term. Additional information is provided in the Standard Contractual Clauses. Fibery takes reasonable steps to ensure that only authorized personnel have access to such Personal Data and that any persons whom it authorizes to have access to the Personal Data are under obligations of confidentiality. Upon Customer request, Fibery shall provide a current SOC 2 Type II report certificate summary covering the Services, and a bridge letter where applicable, under confidentiality.

9.2 Data Privacy contact

gdpr@fibery.io

Fibery Limited
28 Oktovriou, 2, Flat/Office 101
Egkomi, Makedonitissa, 2414
Nicosia, Cyprus

10. Audit rights

Fibery shall make available to the Customer, upon request, all information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer in relation to the Processing of Customer Personal Data.

10.1. Third-Party Audit Reports.

Fibery maintains an independent SOC 2 Type II audit of its information-security controls on an annual basis, performed by an accredited external auditor under AICPA standards. The audit window runs approximately from 28 September of each calendar year to 27 September of the following year, with the final report typically issued within 90 days following the audit period. A summary or bridge letter of the current SOC 2 Type II report will be made available to Customers under a non-disclosure agreement upon written request.

11. List of exhibits:

• Exhibit A – Description of Processing Activities
• Exhibit B – Sub-Processors
• Exhibit C – Technical and Organizational Measures
• Exhibit D - Standard Contractual Clauses (Controller → Processor, Module Two)

EXHIBIT A - Description of Processing Activities

Data Subjects

The transferred personal data concerns the following categories of data subjects: the Data Exporter's end users including employees and contractors; the personnel of the Data Exporter's customers, suppliers and subcontractors.

Categories of data

The transferred personal data concerns the following categories of data: personal data submitted, stored or sent by the Data Exporter or its end users via the Services including identification and contact data (name, address, title, email, userID); employment details where provided (employer, job title); IT information (IP addresses, usage data, cookies data).

Special categories of data (if appropriate)

None

Processing operations

The transferred personal data will be processed in accordance with the Agreement and may be subject to the following processing activities:

• to identify users when authenticating
• provide the Services and related technical support services
• to improve Services.

Exhibit B - Sub-Processors

List of current Fibery Sub-Processors as of the Effective Date:

Ancillary Services Sub-Processors (providing Processor with internal and supporting processing of insignificant amount of Controller Personal Data or no processing at all for some sub-processors and Categories of Controllers)

* For customers based in the United States (per request), Fibery stores Services Data in the Amazon US data centers. Fibery may store in all data centers identifying information about Customer's instance of the applicable Services only.

Exhibit C - Technical and Organizational Measures

The present document supplements the Data Processing Agreement (DPA) between Client and Contractor pursuant to Art 28 GDPR (EU General Data Protection Regulation).

The technical and organisational measures having place in Fibery:

Order Controls

No commissioned data processing within the meaning of Art. 28 GDPR without corresponding instructions from the client, e.g: clear contract design, formalised order management, strict selection of the service provider, obligation to convince in advance, follow-up checks.

Exhibit D – Standard Contractual Clauses (Controller → Processor)

(Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two)

1. Incorporation

1.1 These Standard Contractual Clauses ("SCCs") are entered into between:

(a) Data Exporter (Controller): Customer, as identified in the DPA; and

(b) Data Importer (Processor): Fibery Ltd, 28 Oktovriou 2, Office 101, Egkomi, Makedonitissa, 2414 Nicosia, Cyprus.

1.2 Together, the parties are referred to as the "Parties."

1.3 Capitalized terms not defined herein have the meanings given in the Data Processing Addendum ("DPA").

2. Applicability

2.1 These Clauses form part of and are incorporated into the DPA.

2.2 They apply only to the extent Fibery Ltd, established in Cyprus (EU), transfers Customer Personal Data to any Sub-Processor or affiliate located in a country outside the EEA, Switzerland, or the United Kingdom that does not ensure an adequate level of protection within the meaning of Article 45 GDPR.

2.3 Fibery Ltd performs the majority of processing activities within the EEA; these Clauses therefore primarily govern onward transfers of Customer Personal Data to approved Sub-Processors or personnel located outside the EEA (e.g., the United States).

3. Module Two Selection

3.1 The Parties agree to be bound by the SCCs under Module Two (Controller → Processor) of Commission Implementing Decision (EU) 2021/914.

3.2 The mandatory text of the SCCs (Sections I–IV) is incorporated herein by reference and supplemented by Annexes I–IV below.

Annex I – Description of Transfer

A. List of Parties

Activities relevant to the data transferred: The Data Importer provides the Fibery collaboration and knowledge-management platform and related support services under the Agreement, which involves processing of Customer Personal Data as described below.

B. Description of Transfer

C. Competent Supervisory Authority

For the purposes of Clause 13 of the Standard Contractual Clauses:

1. If the Data Exporter (Customer) is established within the European Union, the supervisory authority of that Member State shall act as the competent authority.
2. If the Data Exporter has no establishment within the EU, the Office of the Commissioner for Personal Data Protection (Cyprus) shall act as the competent supervisory authority, as the Member State in which the Data Importer (Fibery Ltd) is established.

Annex II – Technical and Organizational Measures (TOMs)

2.1 General Principles

Fibery Ltd ("Data Importer") maintains a comprehensive information-security and privacy program designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. All measures are implemented in accordance with:

• Article 32 GDPR,
• recognized industry standards (SOC 2 Type II controls), and
• Fibery's internal security and privacy policies.

The program is reviewed annually, supported by management oversight, and continuously improved based on risk assessments and audits.

2.2 Specific Technical and Organizational Measures

The following controls apply to all processing of Customer Personal Data performed by Fibery Ltd and its authorized Sub-Processors.

(a) Information Security Management

• Formal, documented Information Security Management System (ISMS) aligned with SOC 2 Type II standards.
• Annual risk assessments and regular internal/external security audits.
• Designated Security and Privacy Officer responsible for governance and compliance.
• Mandatory onboarding and annual refresher training for all staff on data-protection, confidentiality, phishing awareness, and secure development practices.
• Signed confidentiality and acceptable-use agreements for all personnel.

(b) Infrastructure and Data Security

• Primary hosting within AWS EU-Central (Frankfurt, Germany) using AWS services certified under ISO 27001, SOC 1/2/3, and CSA STAR.
• Network perimeter protected by firewalls, intrusion-detection, and denial-of-service mitigation.
• Encryption in transit (TLS 1.2 or higher) for all data exchanges.
• Encryption at rest (AES-256 or stronger) for databases, backups, and object storage.
• Redundant infrastructure and automatic fail-over within AWS availability zones.
• Continuous vulnerability management and patching of servers and dependencies.

(c) Access Control

• Role-Based Access Control (RBAC) enforcing least-privilege principles.
• Multi-Factor Authentication (MFA) required for administrative and production access.
• No use of shared credentials or persistent root keys.
• Periodic (at least quarterly) review and prompt revocation of unused or changed-role accounts.
• Access provisioning/de-provisioning integrated with identity-management tooling and approval workflows.

(d) System and Application Security

• Secure Software Development Lifecycle (SDLC) with peer code review, automated dependency scanning, and vulnerability remediation.
• Static/dynamic code analysis and dependency vulnerability alerts integrated into CI/CD pipeline.
• Logging and continuous monitoring using AWS CloudWatch, Sentry, and internal dashboards.
• Segregated development, staging, and production environments; no production data used in testing.
• Regular penetration testing by independent specialists; remediation tracked to closure.

(e) Data Separation

• Logical separation of Customer Data by tenant via dedicated database schemas and identifiers.
• Strict isolation between production, staging, and test environments.
• Segregation of employee-generated data (internal) from customer workspaces.
• Enforced policies preventing cross-tenant data visibility.

(f) Incident and Breach Management

• Documented Incident Response Plan (IRP) defining roles, escalation paths, and communication procedures.
• 24/7 monitoring for anomalous activity and security alerts.
• Prompt investigation, containment, and remediation of security incidents.
• Customer notified without undue delay and no later than 72 hours after confirmation of a Personal-Data Breach.
• Post-incident root-cause analysis and implementation of corrective actions.

(g) Business Continuity and Disaster Recovery

• Daily encrypted backups of critical systems stored within the EU (AWS Frankfurt and secondary EU region).
• Tested restoration procedures ensuring Recovery Point Objective (RPO) ≤ 24 hours and Recovery Time Objective (RTO) ≤ 12 hours.
• Availability-zone redundancy and automated fail-over within AWS infrastructure.
• Uninterruptible power, fire-suppression, and physical security controls at data-center facilities (AWS certified).
• Periodic business-continuity tests and documented contingency plans.

(h) Vendor and Sub-Processor Management

• Due-diligence and risk assessment for all vendors prior to engagement.
• Written Data Processing Agreements (DPAs) and, where applicable, Standard Contractual Clauses (Module Three) with all non-EEA Sub-Processors.
• Annual verification of security certifications (SOC 2, ISO 27001, etc.) and compliance posture.
• Continuous monitoring of Sub-Processor performance and security alerts.
• Fibery performs documented annual security and privacy reviews of all Sub-Processors, including review of certifications, penetration testing summaries, and compliance with contractual obligations.

(i) Audit and Compliance

• Periodic internal audits of ISMS and GDPR controls.
• External audits (SOC 2 Type II, penetration testing) performed at least annually.
• Audit reports and summary results made available to Customers under NDA upon reasonable request.
• Dedicated contact for privacy and audit inquiries: gdpr@fibery.io / privacy@fibery.io.

Annex III – List of Sub-Processors

(pursuant to Clause 9 of the Standard Contractual Clauses)

Fibery Ltd engages the following Sub-Processors to assist in the provision of the Services and the Processing of Customer Personal Data. Each Sub-Processor is bound by a written agreement containing data-protection obligations providing a level of protection no less stringent than those set forth in this DPA and the Standard Contractual Clauses.

III.A - Core Services Sub-Processors

(providing infrastructure hosting or processing a significant amount of Customer Personal Data)

III.B - Ancillary Services Sub-Processors

(providing supporting or internal processing of limited or ancillary Customer Personal Data)

* For customers based in the United States (on request), Fibery may use AWS US data centres. Identifying metadata (e.g., instance ID or configuration) may be stored globally but never includes end-user content.

III.C - Safeguards for Non-EEA Sub-Processors

All Sub-Processors located outside the EEA, Switzerland or the United Kingdom are bound by appropriate transfer safeguards in accordance with Article 46 GDPR, including execution of the Standard Contractual Clauses (Module Three – Processor → Processor) or equivalent lawful mechanisms.

Fibery Ltd ensures that:

1. All non-EEA Sub-Processors execute valid SCCs with Fibery Ltd before any processing begins;
2. Transfer-impact assessments (TIAs) are performed and kept up to date.

Annex IV – Governing Law and Jurisdiction

IV.A Governing Law

These Clauses shall be governed by the law of the EU Member State in which the Data Exporter is established. Where the Data Exporter is not established within the EU, these Clauses shall be governed by the law of the Republic of Cyprus, being the Member State in which the Data Importer (Fibery Ltd) is established. The chosen law shall permit the recognition and enforcement of third-party beneficiary rights.

IV.B Jurisdiction

Any dispute arising from or in connection with these Clauses shall be resolved by the courts of the EU Member State whose law is chosen under Clause 17. Where the Data Exporter is not established in the EU, the Parties agree that any such dispute shall be brought before the competent courts of the Republic of Cyprus. The Parties consent to the jurisdiction of those courts and waive any objection based on lack of personal jurisdiction or forum non conveniens.

Execution

By signing the DPA, the Parties are deemed to have executed these Standard Contractual Clauses, including Annexes I-IV.

Date of document last update: November 2025