Data Processing Agreement

Last Updated: 2 October 2026

Effective Date: 1 October 2026

Governing Regulation: Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR)

1. Parties and Background

This Data Processing Agreement ("DPA") supplements the Omynix Terms of Service and applies between:

1. The Customer: The legal entity or professional person registered for the Omynix hosted cloud service, acting in the capacity of Data Controller ("Controller" or "Customer"); and
2. Omynix: Kaylen Stroeken, a natural person established in Belgium, acting in the capacity of Data Processor ("Processor" or "Omynix").

Formation (Click-Wrap Acceptance)

This DPA is concluded electronically. The Customer accepts this DPA by mandatory click-wrap confirmation when creating a workspace in the customer portal. The timestamp of acceptance and the version of this document are recorded and retained as proof of the agreement.

Recitals

• Whereas Controller has engaged Processor to provide hosted cloud infrastructure monitoring, metrics storage, and alerting services (the "Services");
• Whereas the provision of the Services involves the processing of personal data (such as server IP addresses, administrative access records, and host metadata) by the Processor on behalf of the Controller;
• Whereas the parties desire to establish a legally binding agreement satisfying the mandatory requirements of Article 28(3) and 28(4) of the GDPR;

The parties agree as follows:

2. Definitions and Interpretation

1. Terms such as "Personal Data", "Data Subject", "Processing", "Data Controller", "Data Processor", and "Personal Data Breach" shall have the meanings ascribed to them in Article 4 of the GDPR.
2. "Customer Personal Data" means any Personal Data contained within server telemetry, system performance metrics, network identifiers, system logs, and configuration records ingested into the Processor's hosted micro-hub infrastructure on behalf of the Controller.
3. "Subprocessor" means any third-party processor engaged by Omynix who processes Customer Personal Data in connection with the Services.
4. "Applicable Privacy Law" means the GDPR (Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

3. Scope, Subject Matter, and Instructions

3.1 Role of the Parties

The parties acknowledge that with respect to Customer Personal Data processed within hosted tenant micro-hubs (Model A architecture), Customer acts as the Data Controller and Omynix acts as the Data Processor.

(Note: For account management data, portal credentials, and the Shield threat intelligence consensus network, Omynix acts as an independent Data Controller as detailed in the Privacy Policy).

3.2 Documented Instructions

Processor shall process Customer Personal Data strictly on documented instructions from the Controller, including regarding transfers of Personal Data to a third country or an international organization, unless required to do so by European Union or Member State law to which Processor is subject. In such a case, Processor shall inform Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms of Service, this DPA, and Controller's configuration of monitoring agents constitute Controller's complete and finalized instructions to Processor.

3.3 Prohibited Data Categories

Customer is instructed, and warrants, that it will not place in logs, metrics, FIM targets, or other data sent to the Services:

1. Special categories of personal data pursuant to Article 9 of the GDPR (including health data, biometric data, religious beliefs, or political opinions).
2. Personal data relating to criminal convictions and offenses (Article 10 GDPR).
3. Payment card industry (PCI) cardholder numbers or sensitive financial data.

4. Processor Obligations

Pursuant to Article 28(3) of the GDPR, Processor covenants and agrees to:

4.1 Confidentiality

Ensure that all personnel, contractors, and agents authorized to process Customer Personal Data have committed themselves to strict confidentiality under contract or are under an appropriate statutory obligation of confidentiality.

4.2 Security of Processing (Article 32 GDPR)

Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Customer Personal Data, as detailed in Schedule 1 (Technical and Organizational Measures) of this DPA.

4.3 Subprocessors (Article 28(2) and 28(4) GDPR)

1. General Authorization: Controller grants Processor a general written authorization to engage Subprocessors to assist in delivering the Services.
2. Current Subprocessors: The Subprocessors approved as of the effective date are listed in Schedule 2 of this DPA.
3. Notification of Changes: Processor shall notify Controller of any intended changes concerning the addition or replacement of Subprocessors at least thirty (30) calendar days prior to the engagement of the new Subprocessor. Notice shall be delivered by email from support@omynix.com to the registered administrative email address.
4. Right of Objection: Controller may object to the appointment of a new Subprocessor on reasonable data protection grounds within thirty (30) calendar days of receiving notice. If Controller reasonably objects and the parties cannot reach an amicable resolution, Controller may terminate the affected Services without penalty.
5. Flow-Down Obligations: Processor shall impose data protection obligations on any Subprocessor that are no less protective than those set out in this DPA. Processor remains fully liable to Controller for the performance of the Subprocessor's obligations.

4.4 Assistance with Data Subject Rights (Chapter III GDPR)

Taking into account the nature of the processing, Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Controller's statutory obligation to respond to requests for exercising Data Subject rights:

• Self-Service Export: Processor provides an automated self-service data export facility (POST /settings/export) protected by step-up authentication, enabling Controller to extract Customer Personal Data in a structured, commonly used, and machine-readable JSON format.
• Self-Service Erasure: Processor provides an automated self-service account and instance deletion facility (POST /settings/delete) protected by step-up authentication. A deletion request schedules the erasure: the account remains available for data export during the thirty (30) day export window described in Section 4.7, and when the window ends Processor de-provisions the hosted tenant hubs and permanently erases the account's database records, propagating a cryptographically signed erasure instruction to the Processor-operated identity hub.
• Direct Requests: If a Data Subject submits a request directly to Processor, Processor shall promptly notify Controller and advise the Data Subject to submit their request directly to Controller.

4.5 Assistance with Security and Compliance (Articles 32 through 36 GDPR)

Taking into account the nature of processing and the information available to Processor, Processor shall assist Controller in:

1. Ensuring compliance with security obligations pursuant to Article 32 GDPR.
2. Fulfilling Controller's statutory obligations to notify personal data breaches to supervisory authorities (Article 33 GDPR) and communicate breaches to Data Subjects (Article 34 GDPR).
3. Conducting Data Protection Impact Assessments (Article 35 GDPR) and prior consultations with the supervisory authority (Article 36 GDPR), where required.

4.6 Personal Data Breach Notification (Article 33 GDPR)

1. Notification Window: Processor shall notify Controller without undue delay, and in any event within thirty-six (36) hours, after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
2. Purpose of 36-Hour Window: This accelerated notification timeframe ensures that Controller possesses adequate time to fulfill its statutory obligation to notify the Belgian Data Protection Authority (GBA) within seventy-two (72) hours under Article 33(1) of the GDPR.
3. Contents of Notification: To the extent known at the time of reporting, the notification shall include:
   • A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned.
   • The name and contact details of Processor's security and incident response contact (support@omynix.com).
   • The likely consequences and potential risks of the Personal Data Breach.
   • A description of the mitigation measures taken or proposed to address the breach.
4. No Admission of Fault: Notification of a Personal Data Breach shall not be construed as an admission of fault or liability by Processor.

4.7 Return and Deletion of Customer Personal Data (Article 28(3)(g) GDPR)

1. Export Window: Upon expiration or termination of the Services, Customer Personal Data, including the entire hosted tenant data volume, remains available for export for thirty (30) calendar days.
2. Deletion after Export Window: After the export window, Processor permanently deletes all Customer Personal Data, including the entire hosted tenant data volume, unless European Union or Member State law requires continued storage.
3. Backup Run-Out: Controller acknowledges that automated encrypted backup archives cannot be immediately altered to erase individual database records without compromising archive integrity. Remaining copies are removed through normal rotation of local encrypted backups within approximately seven (7) calendar days (28 snapshots on a 6-hour cycle). Off-site encrypted backups are not currently used; if an off-site backend is enabled later, its retention will be stated in an updated schedule. After the thirty (30) day export window plus local backup rotation, no Customer Personal Data remains.

4.8 Audits and Inspections (Article 28(3)(h) GDPR)

1. Information Provision: Processor shall make available to Controller all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.
2. Audit Procedures: To protect the security, confidentiality, and multi-tenant isolation of other customers sharing the hosting infrastructure, Controller's audit rights are satisfied through the provision of written security information: up-to-date architecture documentation, configuration summaries, security attestations, and penetration test executive summaries, supplied upon written request. Audits do not include physical access to Processor's or its Subprocessors' premises or infrastructure.

5. International Data Transfers

1. European Economic Area (EEA) Storage: Processor covenants that all core hosting infrastructure, tenant hubs, tenant databases, and backup archives are located within Member States of the European Union (Germany and Finland), and transactional email is hosted within the European Union (the Netherlands).
2. No Third-Country Transfers: Processor shall not transfer Customer Personal Data outside the European Economic Area without Controller's prior written consent, unless such transfer is governed by:
   • An adequacy decision adopted by the European Commission pursuant to Article 45 GDPR; or
   • Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR, supplemented by necessary technical and organizational transfer safeguards.

6. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of Belgium. The courts of Antwerp (Belgium) have exclusive jurisdiction over any dispute arising in connection with this DPA.

Schedule 1: Technical and Organizational Measures (TOMs)

Pursuant to Article 32 of the GDPR, Processor has implemented and maintains the following technical and organizational security measures:

1. Measures to Ensure Confidentiality

• Argon2id Hashing: User passwords and credentials are protected with memory-hard Argon2id key derivation using unique cryptographic salts and thread-constrained processing slots. Plaintext passwords are never stored.
• Encryption at Rest: Sensitive credentials, including TOTP two-factor authentication secrets, are stored in SQLite using authenticated AES-256-GCM encryption.
• Cryptographic Signatures: Internal service-to-service communication between the customer portal and tenant micro-hubs is authenticated and signed using asymmetric Ed25519 key pairs, incorporating cryptographic nonces and strict freshness timeouts.
• Strict Multi-Tenant Isolation: Under the Model A architecture, each customer tenant operates with dedicated, logically and physically separated SQLite database files, eliminating co-mingling of tenant monitoring records.
• Role-Based Access Control: Administrative capabilities within the Control Tower are restricted via privileged session validation for the administrative role and separate administrative authentication paths.

2. Measures to Ensure Integrity

• Release Signing: All executable releases and distribution assets are cryptographically signed using OpenSSH signature tooling (SSHSIG) and verified prior to deployment.
• Session Integrity: Active sessions are tracked using cryptographically secure random tokens stored strictly as SHA-256 hashes in database tables.
• Input Sanitization and Validation: All incoming API payloads, JSON structures, and parameter inputs undergo strict schema validation and bounded memory deserialization.

3. Measures to Ensure Availability and Resilience

• Automated Backup Rotation: Production state and databases are snapshot and backed up in encrypted tar archives on a 6-hour cycle with a rolling 28-snapshot (7-day) retention window.
• Pre-deployment Snapshots: The deployment pipeline automatically captures database snapshots prior to binary upgrades to guarantee immediate rollback capability.
• Rate Limiting: Token-bucket rate limiters are enforced on all network endpoints, login challenges, and API routes to protect against resource exhaustion and denial-of-service attempts.
• SSRF Defense: All outbound HTTP requests generated by hubs are screened by internal SSRF egress filters to block access to private RFC 1918 addresses, cloud metadata endpoints, and internal loopbacks.

4. Measures for Regular Testing and Evaluation

• Code Review and Static Analysis: Codebases undergo systematic security audits, static analysis (ast-grep, gosec), and continuous linting.
• Incident Response Runbooks: Documented operational procedures for security incident isolation, credential revocation, and break-glass administrative recovery.

Schedule 2: Authorized Subprocessors

As of the date of this DPA, Processor is authorized to engage the following Subprocessors:

Schedule 3: Details of Processing

A. Subject Matter and Purpose

The subject matter and purpose of the processing of Customer Personal Data is the provision, maintenance, and technical support of the Omynix cloud infrastructure monitoring service as requested by Controller.

B. Duration of Processing

The duration of processing corresponds to the term of Controller's use of the Services, plus the 30-day export window following the end of the account, plus local encrypted backup rotation (approximately 7 days). Off-site backups are not currently used. After the 30-day export window plus local backup rotation, no Customer Personal Data remains.

C. Categories of Data Subjects

• Controller's administrative users, engineers, and employees authorized to manage infrastructure.
• Third-party individuals whose IP addresses or network connections are recorded in system access logs, authentication logs, or network socket tables of monitored customer servers.

D. Types of Personal Data Processed

• Customer administrative user email addresses, names, and session identifiers.
• Server configuration metadata: hostnames, IP addresses, MAC addresses, and network interface identifiers.
• System metrics: performance telemetry, resource usage, process list identifiers, and active service names.
• File integrity telemetry: modified system file paths and SHA-256 file checksums.
• Authentication attempt records: source IP addresses, attempted usernames, and authentication methods of logins observed on monitored servers.
• Security incident snapshots: host state captured at alert fire-time for forensic review.

Contact: support@omynix.com