Data Processing Agreement

1. Scope and acceptance

This Data Processing Agreement ("DPA") forms part of the Business Terms (the "Terms") between AVONAO, INC., a corporation formed in the State of Delaware, USA (Delaware entity file number 10121895), 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA ("Avonao", "we", "us", the "Processor") and the business that accepted the Terms ("Customer", "you"), each a "party".

• Acceptance. This DPA applies automatically, without signature, when you accept the Terms, and it applies for as long as we process Customer Personal Data. Accepting the Terms is also your signature of the Standard Contractual Clauses and the UK Addendum incorporated in section 11. A countersigned copy is not needed for it to be binding.
• When it applies. It applies only where Avonao processes personal data on behalf of the Customer: (a) enterprise connections (Beta), where people with an email address on the Customer's verified domains sign in through the Customer's own OpenID Connect identity provider (for example Entra ID, Okta or Google Workspace); (b) workforce use, where the Customer uses Avonao ID to sign in its own staff or workforce to its own apps and tools; and (c) any other processing the parties agree in writing.
• What it does not cover. It does not apply to a member's own Avonao ID account (sign-in methods, sessions, security log, consent records, data receipts), for which Avonao is the controller, nor to member data the Customer receives in its apps after the member consents, for which the Customer is a separate controller. It also does not apply to personal data for which we are the controller, such as our own website visitors and account and billing administration. The Privacy Policy covers those.

2. Definitions

• "Data Protection Law" means the laws that apply to the processing of Customer Personal Data under the Terms, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as it forms part of the law of the United Kingdom and the Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), and United States state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
• "Customer Personal Data" means personal data that we process on the Customer's behalf under the Terms in the cases described in section 1: the personal data of people who sign in through the Customer's enterprise connection or whom the Customer signs in as staff or workforce, and the Customer's connection configuration.
• "Service" means the Avonao ID service as described in the Terms.
• "Sub-processor" means a processor we engage to process Customer Personal Data.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by us or our Sub-processors.
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force from 21 March 2022, as amended or replaced by the Information Commissioner.
• "Account owner" means a person with the owner role on the Customer's business account in the console.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR, or the equivalent terms in the other Data Protection Law. Where a US state law applies, "controller" includes "business", and "processor" includes "service provider" and "contractor".

3. Roles and instructions

• Roles. You are the controller of Customer Personal Data, or its processor where you process it for your own customer. In that case you confirm that your instructions, including your engagement of us, are authorised by that controller, and you are our single point of contact for it. We are your processor, or your sub-processor.
• Your instructions. We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country. Your documented instructions are the Terms, this DPA, your settings in the console (for example your connection configuration and domains), and other written instructions that are consistent with them. An instruction outside these needs our prior written agreement.
• Unlawful instructions. We will tell you without delay if, in our opinion, an instruction infringes Data Protection Law, and we may suspend the affected processing until you confirm or change it.
• Legal requirements. If a law to which we are subject requires us to process Customer Personal Data otherwise than on your instructions, we will tell you of that requirement before processing, unless that law forbids it on important grounds of public interest.
• Your responsibilities. You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving the notices the law requires to the people you sign in, and configuring your identity provider correctly. You assert only addresses on domains you control. You will not use the Service to process special categories of personal data, criminal-offence data or data about children (see Annex 1). You are responsible for the security of your own systems and credentials, including your client secrets.
• Members' own accounts. In an enterprise connection the person's Avonao ID stays the person's own account, for which Avonao is the controller and which this DPA does not cover. Avonao is a processor for you only for the sign-in it carries out on your behalf: checking that an address is on a domain you have verified, and the records of the connection itself.
• Details of the processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Our obligations

We will:

1. process Customer Personal Data only as set out in section 3;
2. confidentiality: ensure that everyone we authorise to process Customer Personal Data is bound by a written duty of confidentiality or a statutory one, and give access only to those who need it to provide, secure or support the Service;
3. security: implement the technical and organisational measures in section 7 and Annex 2;
4. respect the conditions for engaging Sub-processors in section 5;
5. assist you as set out in sections 6, 7 and 8;
6. delete or return Customer Personal Data as set out in section 10, and make available information and allow audits as set out in section 9;
7. keep the record of processing activities that Data Protection Law requires of a processor, and cooperate with supervisory authorities on request as that law requires;
8. US state privacy laws: not sell Customer Personal Data or share it for cross-context behavioural advertising; not retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with you; not combine it with personal data we receive from or on behalf of others or collect from our own interactions with a person, except as Data Protection Law permits a service provider or contractor; give it the level of privacy protection that law requires; tell you if we determine that we can no longer meet these obligations; and allow you, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.

5. Sub-processors

You give us general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA, with their purpose, location, the personal data involved and the transfer safeguards, are listed on the Sub-processors page, which is Annex 3.

• Flow-down and liability. We will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, as Article 28(4) GDPR requires, and we remain fully liable to you for the performance of each Sub-processor's obligations.
• Notice. We will give you at least 30 days' notice before we add or replace a Sub-processor, by email to the account owners or in the console.
• Objection. You may object on reasonable data protection grounds within those 30 days. We will then work with you in good faith to resolve the objection. If we cannot resolve it, you may end the affected service. If you do not object in time, you are taken to have authorised the change.
• Not Sub-processors. Google, Microsoft and GitHub, when a person chooses to sign in with them, act at the person's own choice and may be independent controllers. Your own identity provider in an enterprise connection is chosen by you and is not our Sub-processor. None of these is a Sub-processor.

6. Assistance

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations to:

• Respond to data subjects. If a data subject writes to us about Customer Personal Data, we will forward the request to you without undue delay, unless the law requires otherwise. We will not answer the request ourselves except on your instruction. The console gives you self-service control of your connection configuration and your domains, and you can remove an enterprise connection at any time. We will give further reasonable help on request to privacy@avonao.com.
• Carry out data protection impact assessments and prior consultation of supervisory authorities, by giving you the information we reasonably hold about the Service, including the measures in Annex 2.
• Keep the processing secure and handle Personal Data Breaches, as set out in sections 7 and 8.

7. Security

We implement and maintain technical and organisational measures that ensure a level of security appropriate to the risk, as Article 32 GDPR requires, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of natural persons. They include the measures in Annex 2. We may update them as the Service and the threats to it change, provided the update does not reduce the overall level of protection.

You are responsible for using the security features the Service offers, such as keeping client secrets confidential, rotating them if they may have been exposed, and configuring your identity provider securely.

8. Personal data breach

• Notice. We will notify the account owners without undue delay, and where possible within 48 hours, after becoming aware of a Personal Data Breach.
• Content. The notice will, to the extent known, describe the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and to mitigate its possible adverse effects; and a contact point for more information. Where not all of this is known at once, we will provide it in phases, without undue further delay, as we learn it.
• Response. We will take reasonable steps to contain, investigate and remedy the breach, and give you the information we hold that you reasonably need to notify supervisory authorities and data subjects. Where you are the controller, those notices are your responsibility, and we will not notify data subjects or authorities on your behalf about Customer Personal Data unless you instruct us to or the law requires it.
• What is not a breach. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, refused sign-in attempts and denial-of-service attacks that expose no data, are not Personal Data Breaches.
• Our notice, or our response to a breach, is not an admission of fault or liability.

9. Audits

We will make available to you the information needed to show that we comply with this DPA and Article 28 GDPR. In the first instance we do this through our documentation, the security description in Annex 2, our published Sub-processor list, our Sub-processors' public compliance reports that we are entitled to share, and written answers to a reasonable security questionnaire sent to privacy@avonao.com.

If that information is not enough to show compliance, or a supervisory authority requires it, or a Personal Data Breach has occurred, you may carry out an audit, including an inspection, yourself or through an independent auditor bound by confidentiality, on these terms:

• no more than once in any 12 months, unless a supervisory authority or a Personal Data Breach requires otherwise;
• on at least 30 days' written notice, with the scope, timing and duration agreed in advance;
• at your cost, during business hours, without disrupting the Service and without access to other customers' data or to our other confidential information;
• limited to the systems and records we use to process Customer Personal Data. Audits of Sub-processors are carried out through the reports and audit rights we have under our contracts with them;
• an auditor that competes with us may be refused, in which case you may appoint another. You will give us a copy of the audit report, which is our confidential information.

If an audit finds that we do not comply with this DPA, we will remedy the non-compliance at our own cost without undue delay. Audits under Clause 8.9 of the SCCs are carried out as set out in this section.

10. Return and deletion

• During the term. You can remove an enterprise connection in the console at any time. When you do, we delete its configuration, including the encrypted client secret, at once.
• The end of the Service. The provision of the Service ends when the Terms end. At your choice, in writing, we return the Customer Personal Data (as a machine-readable export) or delete it, within 30 days of your written choice, and delete existing copies, unless EU or Member State law requires us to keep them. Exporting is how you choose the return of Customer Personal Data under Article 28(3)(g) GDPR.
• Recovery copies. Copies in our hosting provider's point-in-time recovery data (Cloudflare D1 Time Travel) expire on its schedule, up to 30 days, and are not used for any other purpose.
• Not covered. Data in people's own Avonao ID accounts is not covered by this section; those people manage it themselves under the members' Terms of Service and the Privacy Policy.
• Retained records. Security log entries are kept under the retention rules in the Privacy Policy and anonymised when the person's account is purged, and we keep records we must keep by law. For personal data in these records we continue to protect it under this DPA and use it only for the stated purpose.
• Confirmation. On written request we confirm in writing that deletion is complete. The certification of deletion under Clauses 8.5 and 16(d) of the SCCs is given on your written request.

11. International transfers

The Service is operated by a United States company. A person's Avonao ID account data is stored in the data region the person chose at sign-up: US East, US West, Europe Central, Europe West, Europe North, Asia-Pacific or Oceania. The three European regions store data under Cloudflare's EU jurisdiction. Business records, including the Customer's connection configuration, and the pseudonymous sign-in index are stored in our home region, US West. Cloudflare terminates network connections at the location nearest the caller, which can be outside the region; stored data stays in the region. Payments and invoices are handled by Stripe, in the United States and other countries where Stripe operates. See the Privacy Policy section 7.

Where Customer Personal Data subject to the GDPR, the UK GDPR or the FADP is transferred to us, or by us to a Sub-processor, in a country without an adequacy decision, the transfer is covered as follows.

• EU: the SCCs. The SCCs are incorporated into this DPA by reference and completed as follows:
• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer;
• Clause 7 (docking clause) applies;
• Clause 9(a): Option 2 (general written authorisation) applies, with the 30-day notice period in section 5. Copies of Sub-processor agreements under Clause 9(c) may have commercial information removed;
• Clause 11(a): the optional language does not apply;
• Clause 13: the competent supervisory authority is the one set out in Annex 1, section D;
• Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland;
• Clause 18(b): disputes are resolved before the courts of Ireland;
• Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and the list of Sub-processors by Annex 3.
• United Kingdom: the UK Addendum. For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties' details in Annex 1; Table 2 with the SCCs, modules and options selected above; Table 3 with Annexes 1 to 3; and for Table 4, neither party may end the UK Addendum when the Approved Addendum changes. The Mandatory Clauses of the UK Addendum apply, including its rules on governing law and courts and the Information Commissioner as supervisory authority.
• Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" in Clause 18(c) is read so that data subjects in Switzerland can bring claims in their place of habitual residence.
• Data Privacy Framework. Cloudflare, Stripe and GitHub state in their data protection terms that they rely on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework first and on the standard contractual clauses second, as the Sub-processors page shows. Transfers to them may rely on that certification as well as on the SCCs in their own data processing terms.
• Onward transfers. Our contracts with Sub-processors in third countries include the SCCs (Module Three) or another transfer mechanism that Data Protection Law recognises.
• Changes. If a transfer mechanism is invalidated or replaced, we will without undue delay put a valid replacement in place, and the SCCs, the UK Addendum and the Swiss adaptations then continue in the form the law requires. The SCCs prevail over the rest of this DPA in a conflict on a matter they govern.

12. Requests from public authorities

If we receive a legally binding request from a public authority, including a court, for access to Customer Personal Data, we will:

• review the request for its legal basis and scope, and challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful, too broad or in conflict with EU or Member State law;
• tell you before we disclose anything, unless the law forbids it, and in that case use reasonable efforts to obtain a waiver of the prohibition;
• disclose only the minimum the request lawfully requires; and
• keep a record of the requests we receive and our response, which we share with you on request where the law permits.

The measures in section 5 of the EU Data Act page also apply. This section is in addition to Clause 15 of the SCCs.

13. Liability and order of precedence

• Liability. Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Terms, which apply in aggregate to the Terms and this DPA, except where Data Protection Law or the SCCs do not allow a limitation. Nothing in this DPA limits the rights of data subjects under the SCCs or Data Protection Law, or either party's liability to them.
• Order of precedence. In a conflict on the processing of Customer Personal Data: the SCCs and the UK Addendum (where they apply) prevail, then this DPA, then the Terms, then any other document.

14. Term and changes

• Term. This DPA takes effect when you accept the Terms, and remains in force for as long as we process Customer Personal Data, including after the Terms end. Sections 6, 9, 10, 12 and 13 survive for as long as we hold any Customer Personal Data.
• Changes. We may update this DPA where needed to comply with Data Protection Law, to follow guidance or a decision of a supervisory authority or a court, to reflect a new or updated transfer mechanism, or to reflect changes to the Service, provided the update does not reduce the overall protection of Customer Personal Data. We tell account owners about material changes by email at least 15 days before they take effect, as in the Terms. We will not change the SCCs or the UK Addendum other than by adopting a version the European Commission or the Information Commissioner issues.

15. General

• Governing law and venue. This DPA is governed by the law and venue that govern the Terms, which are those of the State of Delaware, except where the SCCs or the UK Addendum provide otherwise.
• Contact points. For the Processor, questions and notices about this DPA go to privacy@avonao.com. For the Customer, we use the email addresses of the account owners, which you keep up to date in the console.
• Representative. Our representative in the European Union under Article 27 GDPR is NUICORN, Chausseestraße 86, 10115 Berlin, Germany. It may be contacted through privacy@avonao.com on all matters about this DPA.
• Severability. If a provision of this DPA is invalid or unenforceable, the rest of it remains in force, and the provision is read so as to give effect, as far as the law allows, to its intent.

Annex 1: Description of the processing

This Annex is also Annex I of the SCCs.

A. List of parties

Data exporter

• Name and address: the Customer, as named in its business account.
• Contact person: the account owner, at the email address in the console.
• Activities relevant to the data transferred: use of the Avonao ID service under the Terms, through enterprise connections or workforce sign-in.
• Role: controller (Module Two) or processor (Module Three).
• Signature and date: by accepting the Terms, on the date of acceptance.

Data importer

• Name and address: AVONAO, INC., 254 Chapman Rd, Ste 208 #21918, Newark, Delaware 19702, USA (legal address). Mailing address, for general correspondence only: AVONAO, INC. • 2261 Market Street PMB 10671, San Francisco, CA, 94114, United States. Legal correspondence, including notices under this DPA, must be sent to the legal address in Delaware.
• Contact: privacy@avonao.com. EU representative: NUICORN, Chausseestraße 86, 10115 Berlin, Germany.
• Activities relevant to the data transferred: provision of the Avonao ID service.
• Role: processor.
• Signature and date: by making the Service available under the Terms, on the date the Customer accepts them.

B. Description of the processing and transfer

Categories of personal data, by kind of data:

C. Retention

D. Competent supervisory authority

The supervisory authority of the EU Member State in which the Customer is established. Where the Customer is not established in the EU but falls within Article 3(2) GDPR and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which that representative is established. Where the Customer has not had to appoint one, the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located. For the UK Addendum, the Information Commissioner; for Swiss transfers, the Federal Data Protection and Information Commissioner.

Annex 2: Technical and organisational measures

This Annex is also Annex II of the SCCs. The measures describe how the Service works today.

• Authentication and credentials. No passwords are stored. Passkeys store only the public key. Email sign-in links and codes are single-use, expire after 10 minutes and allow at most 5 code attempts. An optional second factor (TOTP) has replay protection, and recovery codes are stored only as hashes and shown once. Sensitive account changes require a fresh confirmation within the last 10 minutes. Sessions expire after 14 days without use and at the latest after 90 days, and members can see and end their sessions. The session cookie is __Host- prefixed, Secure, HttpOnly and SameSite=Lax.
• Protocol security. OpenID Connect authorization code flow with PKCE (S256), exact redirect URI matching, short-lived authorization codes (60 seconds) and access tokens (10 minutes). ID tokens are signed with ES256. Signing keys rotate; a new key is published at least 24 hours before it signs, and a compromised key can be removed from the published key set at once. In an enterprise connection, the identity provider's ID token is verified (signature from its published keys, issuer, audience, expiry, nonce) and the asserted email must be on a domain the Customer verified.
• Roles. Business roles (owner, admin, developer) apply least privilege. Invitations can only be accepted by the invited, confirmed email address.
• Tenancy isolation. A person's data lives in one regional database, reached only by that region's service. A cookie or token from another region is refused, and nothing is read from or written to another region as a fallback. Third-party apps receive a pairwise identifier per business, never the account id, and only the scopes the member allowed.
• Encryption. All traffic uses https. Secrets that must be readable by the service (TOTP secrets, token signing private keys, webhook signing secrets, enterprise connection client secrets) are encrypted with AES-256-GCM under a key-encryption key that is held as a platform secret and never stored in the database; encryption is bound to the record it belongs to. Tokens are stored only as SHA-256 hashes: session tokens, email link tokens and codes, authorization codes, access tokens, sign-in state, second-factor challenges, invitation tokens and app client secrets. The database is encrypted at rest by the hosting provider (Cloudflare D1), as Cloudflare documents.
• Minimisation and pseudonymisation. Platforms report only whether a subscription is none, free or paid; no prices or billing data are stored. Verified, only when enabled, stores the outcome and trust level, never document images.
• Outbound request controls. Webhooks are signed with HMAC-SHA256 and a timestamp; outgoing requests do not follow redirects and time out after 5 seconds.
• Rate limiting and abuse controls. Rate limits on sign-in, code entry, the token endpoint, business creation, invitations, domain verification, reports, follows and other actions. Bot protection (Cloudflare Turnstile) on sign-up and business creation, which fails closed. Browser requests that change data must come from the same origin.
• Logging and monitoring. A security log records sign-ins and account changes per member, and an audit log records business events, which the Customer can read in the console.
• Access by our personnel. Access to production is limited to named Avonao staff who are bound by confidentiality. Administrative functions require a separate bearer token, compared in constant time, which is held by named Avonao staff and stored as a platform secret, never in the database.
• Resilience and recovery. The Service runs on Cloudflare's platform, with a database per data region. The hosting provider's point-in-time recovery of each database is always on (30 days on the paid plan Avonao uses) and is not used except to restore the service after a failure. Expired short-lived records are deleted daily.
• Incidents. Incidents are handled under Avonao's breach process, and the Customer is told under section 8.
• Vulnerability handling. We accept and act on reports under our Responsible disclosure policy.
• Sub-processors. We review Sub-processors before we add them and engage them under written contracts as set out in section 5, and the measures they apply to Customer Personal Data are described in their own data processing terms.

Annex 3: Sub-processors

The Sub-processors are those listed on the Sub-processors page, which sets out each one's purpose, location, the personal data involved and the transfer safeguards. The list in force on the date of this DPA, and each change notified under section 5, forms this Annex. On the date of this DPA, the Sub-processors that process Customer Personal Data in the Service include Cloudflare, Inc. (hosting (Workers), databases (D1), email sending, bot protection (Turnstile), network and DNS; databases in the member's chosen region, one of seven, and business records and the pseudonymous sign-in index in the home region US West), Stripe, LLC (payments for business plans, and, only when Verified is enabled and the person chooses to verify, identity verification) and Microsoft Corporation, with Microsoft Ireland Operations Limited for the EEA, the UK and Switzerland (Microsoft 365, company mailboxes for support correspondence). Analytics and error-monitoring tools on our own websites are designed not to receive Customer Personal Data; before any of them can receive it, it is added to the Sub-processors page with the notice in section 5.