Data Processing Agreement

Parties

• "Keelstamp", "we", "us": PowerQuant ApS, a company registered in Denmark under CVR number 46274067, with its address at Provstlund Skovvej 1, 8700 Horsens, Denmark. Data protection contact: privacy@keelstamp.com.
• "Partner", "you": the business that has accepted the Terms (the "Customer" in the Terms).

1. Definitions

1.1 "Personal data", "processing", "controller", "processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given in Regulation (EU) 2016/679 ("GDPR") and, where it applies, the UK GDPR. "Data Protection Law" means the GDPR, the UK GDPR and the national laws that implement or supplement them, as they apply to the processing.

1.2 "End-Client": a business that is the Partner's client and on whose behalf the Partner uses Keelstamp.

1.3 "Approver", "Action", "Receipt", "Workspace" and "BYOK" have the meanings given in the Terms.

1.4 "End-Client Data": personal data that the Partner, an End-Client or an Approver submits to Keelstamp, or that Keelstamp generates for them, in the course of the Service, except the data described in section 2.3.

1.5 "Service": the Keelstamp service described in the Terms.

1.6 "Sub-processor": a third party that we engage and that processes End-Client Data.

1.7 "Standard Contractual Clauses": the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 For End-Client Data, the End-Client is the controller, the Partner is the End-Client's processor, and we are the Partner's sub-processor. Where the Partner is itself the controller of End-Client Data, we are the Partner's processor, and this Agreement applies accordingly.

2.2 The Partner confirms that (a) its agreement with each End-Client allows the Partner to engage us and the Sub-processors listed under section 7 (Article 28(2) GDPR), and (b) this Agreement meets the data protection obligations that the Partner must pass on to us under Article 28(4) GDPR. Obligations that the Partner has agreed with an End-Client and that go further than this Agreement bind us only if we have agreed to them in writing.

2.3 We are an independent controller, and this Agreement does not apply, for:

• (a) data about the Partner's account, users and billing, and our communication with the Partner; and
• (b) sign-in, authentication and security logs of all users of Keelstamp, including Approvers, which we process to keep our platform secure.

Our Privacy Policy at keelstamp.com/privacy describes that processing. The content of Actions and the decisions recorded on them are End-Client Data.

2.4 Your own model keys (BYOK). When the Partner connects its own account with an AI model provider, that provider processes the model requests under the Partner's own agreement with it, and it is not our Sub-processor. We transmit those requests to the provider on the Partner's instructions and do not store their content; our service logs record only technical information about them, such as time, status and cost. The account with the provider, and the agreement with it, must be in the name of the Partner or the End-Client. The Partner is responsible for that agreement, including any safeguards for transfers to the provider.

2.5 The details of the processing are set out in Annex I.

3. The Partner's obligations

3.1 The Partner ensures, and ensures that each End-Client ensures, that there is a lawful basis for the processing of End-Client Data in Keelstamp, and that data subjects, including Approvers, are informed about that processing as required by Articles 13 and 14 GDPR.

3.2 The Partner does not submit, and ensures that End-Clients do not submit, special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). If such data is submitted, the consequences set out in the Terms apply.

3.3 The Partner ensures that its instructions to us comply with Data Protection Law and with the End-Client's instructions to the Partner.

4. Instructions (Article 28(3)(a) GDPR)

4.1 We process End-Client Data only on the Partner's documented instructions, including with regard to transfers of personal data to a third country. The Terms, this Agreement and the Partner's configuration of the Service are the Partner's complete instructions when this Agreement is entered into. Further instructions must be given in writing and be consistent with the Terms.

4.2 If Union or Member State law requires us to process End-Client Data in another way, we inform the Partner of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

4.3 We inform the Partner immediately if, in our opinion, an instruction infringes Data Protection Law.

4.4 Aggregated statistics. The Partner instructs us to combine End-Client Data and data about the use of the Service into aggregated statistics that do not identify the Partner, any End-Client or any natural person, and to do so before the statistics are used for any purpose. We use those statistics only to operate and improve the Service, and we do not attempt to identify anyone from them. The Partner confirms that its agreement with each End-Client allows this instruction.

5. Confidentiality (Article 28(3)(b) GDPR)

We ensure that the persons we authorise to process End-Client Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process End-Client Data only on the Partner's instructions.

6. Security (Articles 28(3)(c) and 32 GDPR)

6.1 We implement the technical and organisational measures set out in Annex II.

6.2 We may change those measures, provided the overall level of protection is not reduced.

7. Sub-processors (Articles 28(2), 28(3)(d) and 28(4) GDPR)

7.1 The Partner gives us general written authorisation to engage the Sub-processors on our list at keelstamp.com/sub-processors (Annex III). The list shows each Sub-processor's name, what it does for us, where it processes data and the transfer safeguard used.

7.2 We inform the Partner in writing at least 30 days before we add or replace a Sub-processor. The Partner may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Partner may terminate the affected part of the Service before the change takes effect, and we refund the prepaid fees for the remaining period of that part pro rata, as set out in section 8.7 of the Terms.

7.3 If we must replace a Sub-processor urgently to keep the Service secure or available, or if a Sub-processor gives us shorter notice than the period in section 7.2, we inform the Partner as soon as possible and no later than when the change takes effect. The Partner's right to object and to terminate under section 7.2 applies.

7.4 Our list links to each Sub-processor's own list of the providers it uses. When a Sub-processor notifies us of a change to that list, we pass the notice on to the Partner without undue delay.

7.5 We engage only Sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures. We impose on each Sub-processor, by written contract, the same data protection obligations as those in this Agreement in substance.

7.6 We remain liable to the Partner for the performance of our Sub-processors' obligations, subject to section 14.

7.7 If the Partner has factually disappeared, has ceased to exist in law or has become insolvent, each affected End-Client may terminate this Agreement for its Workspace and instruct us to return or erase its End-Client Data. The End-Client may enforce this section directly against us.

8. Requests from data subjects (Article 28(3)(e) GDPR)

8.1 Taking into account the nature of the processing, we assist the Partner by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects to exercise their rights.

8.2 If we receive such a request about End-Client Data directly, we forward it to the Partner without undue delay and do not respond to it ourselves unless the Partner instructs us to. We answer requests about the data described in section 2.3 ourselves.

9. Assistance (Article 28(3)(f) GDPR)

We assist the Partner in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us. This includes giving the Partner the information it reasonably needs for a data protection impact assessment or a prior consultation with a supervisory authority.

10. Personal data breaches (Article 33(2) GDPR)

10.1 We notify the Partner without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting End-Client Data.

10.2 The notice describes, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; a contact point for more information; the likely consequences of the breach; and the measures taken or proposed to address the breach and to mitigate its possible adverse effects. Where we cannot give all of this at the same time, we give it in phases without further undue delay.

10.3 We send notices to the security contact the Partner has given in its account or, if there is none, to the account email address.

10.4 We document each personal data breach affecting End-Client Data, including the facts relating to it, its effects and the remedial action taken.

10.5 A notice under this section is not an acknowledgement of fault or liability.

11. Return and erasure (Article 28(3)(g) GDPR)

11.1 The Partner can export its End-Client Data and Receipts as Exportable Data under sections 14.4 and 14.5 of the Terms, including for at least 30 days after the transitional period or, if there is none, after the Service ends. We then erase the End-Client Data and existing copies, unless Union or Member State law requires us to store them. The same applies to a single Workspace when the Partner closes it.

11.2 Receipts and our service logs contain no plain-text personal data. Sign-in, authentication and security logs are not covered by this Agreement (section 2.3). A Receipt identifies the End-Client and the Approver only by keyed commitments, made with keys that are unique to each End-Client. On erasure, we destroy that End-Client's keys (subject to section 11.3 on backups), after which the remaining entries can no longer be linked to an identifiable person. When our public transparency log is published, it will contain only aggregated batch roots. We never publish a hash or commitment for an individual entry.

11.3 Backups may contain End-Client Data and the keys in section 11.2 for up to 7 days after erasure. We do not use backups for any other purpose, and we overwrite them on a fixed schedule. If we ever restore a backup, we repeat the erasure before the restored data is used.

11.4 On request, we confirm the erasure in writing.

11.5 Copies of Receipts that the Partner or an End-Client has downloaded are under its own control.

12. Information and audits (Article 28(3)(h) GDPR)

12.1 We make available to the Partner all information necessary to demonstrate compliance with Article 28 GDPR. This includes this Agreement, Annex II, our Sub-processor list and, on request once in any period of 12 months, a written statement on our compliance with this Agreement, including any personal data breaches and changes of Sub-processors since the previous statement.

12.2 We allow for and contribute to audits, including inspections, conducted by the Partner, by an End-Client or by an independent auditor mandated by either of them and bound by confidentiality. An audit takes place with at least 30 days' written notice, during normal business hours, without disrupting the Service and without access to other customers' data. Where the information in section 12.1 answers the questions of the audit, we may provide it instead of an inspection, unless the Partner or the End-Client reasonably considers an inspection necessary.

12.3 There is no more than one audit under section 12.2 in any period of 12 months, except where a supervisory authority requires an audit or after a personal data breach affecting End-Client Data. In those cases, reasonable notice applies instead of the notice period in section 12.2.

12.4 For Sub-processors, we provide their own audit reports, certifications or other documentation, where available.

12.5 Each party bears its own costs of an audit.

13. Transfers outside the EU/EEA

13.1 We are established in Denmark. Annex III shows where each Sub-processor processes data and the safeguard used for each transfer.

13.2 We transfer End-Client Data to a Sub-processor in a third country only where:

• (a) the European Commission has decided that the country, or the recipient as a participant in the EU-U.S. Data Privacy Framework, ensures an adequate level of protection; or
• (b) the Standard Contractual Clauses, Module Three (processor to processor), apply between us and the Sub-processor.

Where a Sub-processor relies on the Data Privacy Framework, we keep the Standard Contractual Clauses in place as well, where the Sub-processor's terms provide them. For personal data subject to the UK GDPR, the UK International Data Transfer Addendum, the UK International Data Transfer Agreement or the UK Extension to the Data Privacy Framework applies, as shown in Annex III.

13.3 Where the Partner or an End-Client is established in a third country that is not covered by an adequacy decision of the European Commission, and receives End-Client Data from us, the Standard Contractual Clauses are incorporated into this Agreement by reference: Module Three (processor to processor) where the Partner acts as the End-Client's processor, and Module Four (processor to controller) where the Partner is itself the controller. We are the data exporter, and the Partner is the data importer, for itself and for its End-Clients. For both modules: the optional clause 7 (docking clause) applies; the option in clause 11(a) does not apply; under clause 17 the clauses are governed by Danish law; and under clause 18 disputes are resolved by the courts of Denmark. For Module Three: under clause 9(a), Option 2 (general written authorisation) applies, and the time period for informing of intended changes to the list of sub-processors is 30 days; and the competent supervisory authority under clause 13 is the Danish Data Protection Agency (Datatilsynet), Denmark. Annexes I to III of this Agreement complete the annexes to the clauses. If the clauses conflict with this Agreement, the clauses prevail.

13.4 Section 13.3 does not apply where the importer's processing of the data is itself subject to the GDPR under Article 3(2) GDPR. In that case, the Partner informs us, and the parties will use standard clauses for that situation when the European Commission adopts them.

13.5 If a transfer mechanism we rely on ceases to be valid, we move the transfer to another valid mechanism or stop it, and we inform the Partner without undue delay.

14. Liability

14.1 The Terms and this Agreement share one aggregate cap. Each party's total aggregate liability under the Terms and this Agreement together is limited to the greater of the fees paid in the 12 months before the claim and DKK 5,000.

14.2 This limit does not apply to liability for wilful misconduct or gross negligence, liability that cannot be limited by law, our refund obligations, the Partner's payment obligations, or the Partner's indemnity under the Terms.

14.3 The exclusion of indirect loss in the Terms also applies to this Agreement.

14.4 Nothing in the Terms or this Agreement limits the rights of data subjects under Article 82 GDPR or the UK GDPR. Where one party has paid compensation to a data subject, it may claim back from the other party the part of the compensation that corresponds to the other party's responsibility for the damage (Article 82(5) GDPR), within the limit in section 14.1.

14.5 Each party bears any fine imposed on it.

15. Term, precedence, changes and law

15.1 This Agreement applies for as long as we process End-Client Data for the Partner, including the export and erasure period in section 11.

15.2 For the processing of personal data, this Agreement prevails over the Terms. Where the Standard Contractual Clauses apply, they prevail over this Agreement.

15.3 We may change this Agreement as set out in the Terms, with at least 30 days' notice. A change required by Data Protection Law or by a supervisory authority may take effect sooner, and we tell the Partner why. If a change adversely affects the Partner, the Partner may terminate as set out in section 15.2 of the Terms.

15.4 This Agreement is governed by Danish law, excluding its conflict-of-law rules. The courts of Denmark, with the District Court of Horsens (Retten i Horsens) as the court of first instance, have exclusive jurisdiction. This does not limit the rights of data subjects or supervisory authorities, or section 13.3.

Annex I — Details of the processing

1. Subject matter: providing the Service to the Partner, which uses it to request, record and prove approvals of automated Actions for its End-Clients.

2. Duration: the term of the Partner's subscription, plus the export and erasure period in section 11.

3. Frequency: continuous.

4. Nature of the processing: receiving, storing, displaying, signing, logging, transmitting and erasing data, and combining it into aggregated statistics under section 4.4.

5. Purposes:

• showing a pending Action to an Approver and recording the decision;
• enforcing the End-Client's spending cap and emergency stop;
• issuing Receipts and, once the transparency log is published, publishing its batch roots;
• sending service emails, including approval links;
• transmitting model requests to the Partner's own AI model provider (BYOK), without storing their content;
• producing aggregated statistics under section 4.4.

6. Categories of data subjects:

• Approvers and other staff of End-Clients;
• users of the Partner, where they appear in End-Client Data;
• individuals whose data appears in the content of an Action or a model request (for example the recipient of an invoice or a message).

7. Categories of personal data:

• Approver contact data: email address for delivering approval links, and optionally a display name;
• Action details: summary, Action type, amount and any personal data the Partner includes, stored encrypted;
• decision records: the decision, its time, and keyed commitments of the End-Client and the Approver;
• technical data: IP address and user-agent, processed in transit by our hosting and network providers;
• model requests and responses, in transit only, where the Partner uses BYOK through Keelstamp.
• Not covered by this Agreement: sign-in, authentication and security logs (section 2.3).
• Special categories of personal data (Article 9 GDPR) and personal data relating to criminal convictions and offences (Article 10 GDPR) must not be submitted (section 3.2).

8. Retention during the term:

• encrypted Action details: 35 days after the decision on the Action or its expiry;
• service logs: at least 6 months and at most 12 months; service logs are designed to contain no plain-text personal data;
• Receipts: for the term of the subscription, until the Partner closes the Workspace, or until the end of the export period in section 11, whichever comes first;
• backups: up to 7 days.

9. Sub-processors: Annex III.

10. Parties for the purpose of section 13.3 (Modules Three and Four): data exporter: Keelstamp (processor); data importer: the Partner (controller, or processor acting for its End-Clients); contact details: as in this Agreement and the Partner's account; competent supervisory authority (Module Three): the Danish Data Protection Agency (Datatilsynet), Denmark.

Annex II — Technical and organisational measures

Measured in place on 17 October 2026:

• The primary database is hosted by Supabase in AWS region eu-central-1 (Frankfurt, Germany). Our provider states that it encrypts stored data with AES-256, and data in transit with TLS.
• Every Keelstamp database table has row-level security enabled and forced. The anonymous public role has no privileges on any Keelstamp table. Signed-in users can read, but not change, the rows of their own Partner account in two tables, and nothing else.
• An automated check runs every day and reports any Keelstamp table without row-level security or with privileges for public roles that are not intended.
• Operational logs of the Keelstamp platform are append-only at database level.

Not yet in place / not yet confirmed (listed so that nothing here is read as a promise):

• Isolation of End-Client Data per Partner and per End-Client (no End-Client Data is processed yet).
• Encryption of Action details at application level, with a key held outside the database and time-limited retention.
• Encryption of customer-supplied model keys with a key held outside the database.
• Keys per End-Client for Receipts, and erasure by destroying those keys.
• Logging that excludes personal data by allowlist.
• Web application firewall and rate limiting in front of the API.
• Encrypted backups with regular restore tests.
• Multi-factor authentication on all administrative accounts.
• Dependency and secret scanning in the build pipeline.
• A documented process for incident response and breach notification.

Annex III — Sub-processors for End-Client Data

The current list is published at keelstamp.com/sub-processors. At the date of this version, it is expected to contain the providers below.

Planned, not in use:

Providers that are not Sub-processors for End-Client Data:

• GitHub, Inc. hosts our source code and will host the public transparency log once it is published. The log will contain only batch roots, which contain no personal data.
• Stripe processes data about the Partner only (section 2.3).
• AI model providers used with BYOK are the Partner's own providers (section 2.4).