Data Processing Addendum

1. Scope and incorporation

This Data Processing Addendum ("DPA") forms part of the Terms of Service between EverXCloud Inc., a Delaware corporation ("EverXCloud", "we", "us") and the Business Customer ("Customer", "you") and applies whenever EverXCloud processes Customer Personal Data in providing the Services. It is incorporated into the Terms of Service by reference and takes effect, without signature, when the Customer accepts the Terms of Service. A Customer that requires a signed copy may request one at [email protected].

This DPA does not apply to Individual Customers using the Services for purely personal purposes, nor to personal data that EverXCloud processes as an independent controller (such as account, billing, identity verification, compliance and support data), which is governed by the Privacy Policy.

2. Definitions

Terms not defined in this DPA have the meaning given in the Terms of Service.

• "Data Protection Laws" means all laws relating to the processing of personal data that apply to a party in connection with the Services, including, as applicable, the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the CCPA and other United States state privacy laws.
• "GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.
• "CCPA" means the California Consumer Privacy Act of 1999 as amended, and its implementing regulations.
• "Customer Personal Data" means personal data contained in the content, files, software, models, datasets and other data that the Customer or its users upload to, store on, or process with Instances and other resources of the Services ("Customer Content").
• "Sub-processor" means any processor engaged by EverXCloud to process Customer Personal Data, including Providers.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by EverXCloud or its Sub-processors.
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "controller", "processor", "data subject", "personal data", "processing", "business", "service provider", "sell" and "share" have the meanings given in the applicable Data Protection Laws.

3. Roles of the parties

With respect to Customer Personal Data, the Customer is the controller (or business) and EverXCloud is a processor (or service provider). Where the Customer acts as a processor on behalf of a third-party controller, EverXCloud acts as the Customer's sub-processor, and the Customer warrants that its instructions and the engagement of EverXCloud have been authorised by that controller.

Each party complies with the obligations that Data Protection Laws impose on it. The Customer is responsible for the lawfulness of the processing of Customer Personal Data, including having a legal basis for it, providing the required information to data subjects, and for the accuracy and quality of Customer Personal Data and the means by which it was obtained.

4. Details of the processing

• Subject matter: provision of GPU computing infrastructure (Instances, network access and related Services) to the Customer.
• Nature: hosting, storage, computation and transmission performed automatically by the infrastructure at the Customer's direction. EverXCloud provides infrastructure only: it does not access, inspect, analyse or use Customer Content, except as necessary to provide the Services, to prevent or address a security or technical problem, to investigate a suspected breach of the Acceptable Use Policy or to comply with the law, in each case as permitted by this DPA.
• Purpose: performance of the Terms of Service and of the Customer's Orders.
• Duration: the term of the Terms of Service and the period until deletion of Customer Personal Data in accordance with Section 12.
• Categories of data subjects and of personal data: determined solely by the Customer, depending on the Customer Content it chooses to process. The Customer shall not process special categories of personal data, personal data relating to criminal convictions or offences, protected health information or payment card data through the Services unless it has implemented appropriate safeguards and, where required by the Acceptable Use Policy, obtained EverXCloud's prior written agreement.
• Location: the data center selected by the Customer for each Instance, as indicated in the Portal.

5. Processing on documented instructions

EverXCloud processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by a law to which EverXCloud is subject; in that case, EverXCloud informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms of Service, this DPA, the Customer's configuration and use of the Services and its Orders constitute the Customer's complete instructions. Additional instructions require EverXCloud's written agreement and may be subject to charges. EverXCloud informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Laws; it is not required to carry out a legal review of Customer Content.

6. Confidentiality

EverXCloud ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to personnel who need it to provide the Services.

7. Security measures

EverXCloud implements and maintains the technical and organisational measures described below, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks for the rights and freedoms of natural persons. EverXCloud may update these measures provided that the overall level of security is not materially reduced.

• Isolation: each Instance runs in an isolated environment; Customer Content is not shared between Customers.
• Workspace encryption and erasure: Instance workspaces are encrypted with a random key that is never written to disk and is destroyed when the Instance ends, rendering the data unreadable; where encryption is not available on a host, the workspace is overwritten before deletion.
• Encryption in transit: access to the Portal and the application programming interface uses TLS; access to Instances uses SSH or encrypted connections.
• Encryption at rest of sensitive platform data and of backups, with keys held separately from the encrypted data.
• Access control: least-privilege access, multi-factor authentication for administrative access, individual accounts and logging of administrative actions.
• Network security: firewalls, rate limiting and protection against denial-of-service attacks through our content delivery and security provider.
• Operational security: security updates, monitoring and alerting, vulnerability management and documented incident response.
• Resilience: daily encrypted backups of platform data stored off-site; Customer Content on Instances is not backed up by EverXCloud unless the Customer uses a Service expressly providing for it.
• Sub-processors and Providers: contractual obligations providing at least the same level of protection as this DPA, including isolation, erasure of storage between rentals and incident notification.

The Customer is responsible for the security of its use of the Services, including protecting its account credentials, API keys and SSH keys, configuring its Instances securely, encrypting Customer Content where appropriate and keeping its own backups.

8. Sub-processors

The Customer grants EverXCloud a general authorisation to engage Sub-processors, including Providers operating the hardware on which Instances run and EverXCloud's infrastructure service providers. The current list of Sub-processors, with their location and function, is available to the Customer on request at [email protected].

EverXCloud notifies the Customer of any intended addition or replacement of a Sub-processor at least 15 days in advance, by email or through the Portal. The Customer may object on reasonable grounds relating to data protection by writing to [email protected] within that period. The parties will discuss the objection in good faith; EverXCloud may propose an alternative, such as running the Customer's workloads only in locations that do not use the Sub-processor concerned. If no solution is found within 30 days, the Customer may terminate the affected Services and obtain a refund of the unused Prepaid Balance in accordance with the Refund and Cancellation Policy, which is the Customer's sole remedy for the objection.

Where the Customer selects a specific Provider, location or offer in the Portal, that selection constitutes the Customer's instruction and authorisation to use the Provider concerned.

EverXCloud imposes on each Sub-processor, by written contract, data protection obligations providing at least the same level of protection as this DPA, and remains liable to the Customer for the performance of the Sub-processor's obligations in accordance with Data Protection Laws and subject to Section 16.

9. Assistance with data subject requests

Taking into account the nature of the processing, EverXCloud assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects. Because the Customer controls Customer Content, the Customer will in most cases respond to requests directly using the Services. If EverXCloud receives a request from a data subject relating to Customer Personal Data, it will refer the data subject to the Customer where the Customer is identifiable and will not respond itself, except to confirm the referral or as required by law.

10. Assistance with security, impact assessments and consultations

Taking into account the nature of the processing and the information available to it, EverXCloud provides reasonable assistance to the Customer in ensuring compliance with its obligations relating to the security of processing, data protection impact assessments and prior consultation of supervisory authorities, in particular by providing information on the Services and the measures described in Section 7. Assistance going beyond such information may be subject to reasonable charges.

11. Security Incidents

EverXCloud notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident. The notification is sent to the email address associated with the Customer's account and describes, to the extent known, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where information is not available at once, it is provided in phases without undue further delay.

EverXCloud takes reasonable steps to contain, investigate and mitigate the Security Incident and cooperates with the Customer so that it can meet its own notification obligations. Notification of a Security Incident is not an acknowledgement of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans or failed log-in attempts, are not Security Incidents.

12. Deletion and return

The Customer may retrieve Customer Content at any time during the term using the Services. At the end of an Instance, its workspace is destroyed as described in Section 7. EverXCloud does not provide persistent storage. Any other stored Customer Content is deleted in accordance with the Terms of Service, and at the latest within 30 days after termination of the Terms of Service, unless a law to which EverXCloud is subject requires further storage.

Customer Content that has been deleted cannot be recovered. It is the Customer's responsibility to retrieve Customer Content before the end of an Instance.

13. Information and audits

EverXCloud makes available to the Customer the information necessary to demonstrate compliance with this DPA and Article 28 of the GDPR and of the UK GDPR. The Customer agrees to exercise its audit rights first by reviewing that information, including written answers to reasonable security questionnaires and any third-party audit reports that EverXCloud may have obtained.

If that information is not sufficient to demonstrate compliance, or where a supervisory authority so requires, the Customer may conduct, itself or through an independent auditor bound by confidentiality and not a competitor of EverXCloud, an audit or inspection, no more than once in any twelve-month period (except following a Security Incident affecting the Customer or at the request of a supervisory authority), on at least 30 days' written notice, during business hours, without disrupting the Services and subject to the protection of the confidential information of EverXCloud, its other customers and Providers. The Customer bears the costs of the audit and reimburses EverXCloud's reasonable costs. Audits of Providers are conducted through the information and audit rights EverXCloud holds under its contracts with them.

14. International transfers

EverXCloud is established in the United States and processes Customer Personal Data in the United States and in the locations selected by the Customer. The Customer authorises transfers of Customer Personal Data to the United States and to the locations of the Sub-processors, subject to this Section.

To the extent that EverXCloud's processing involves a transfer of Customer Personal Data subject to the GDPR to a country that does not benefit from an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor; the Customer is the data exporter and EverXCloud the data importer; clause 7 (docking clause) applies; under clause 9(a), option 2 (general written authorisation) applies with the notice period set out in Section 8; the optional wording of clause 11(a) does not apply; under clause 13, the competent supervisory authority is determined in accordance with that clause; under clause 17, the SCCs are governed by the law of Ireland; under clause 18, disputes are resolved by the courts of Ireland; Annex I is completed by Sections 3 and 4 of this DPA and the Customer's account details; Annex II is completed by Section 7; Annex III is completed by the list referred to in Section 8.

For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference, completed with the information above; neither party may end the UK Addendum under its section 19. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the necessary adaptations, the Swiss Federal Data Protection and Information Commissioner being the competent supervisory authority and references to Member States including Switzerland.

In case of conflict between the SCCs or the UK Addendum and this DPA or the Terms of Service, the SCCs or the UK Addendum prevail. EverXCloud may replace the transfer mechanism above by another mechanism recognised under Data Protection Laws, including a certification under the EU-U.S. Data Privacy Framework, by notice to the Customer.

15. CCPA service provider terms

To the extent that Customer Personal Data includes personal information subject to the CCPA or a similar United States state privacy law, EverXCloud acts as a service provider (or processor) and processes it for the limited and specified business purpose of providing the Services described in the Terms of Service. EverXCloud shall not:

• sell or share the personal information;
• retain, use or disclose the personal information for any purpose, including any commercial purpose, other than the business purposes specified in this DPA, or outside the direct business relationship between EverXCloud and the Customer, except as permitted by the CCPA;
• combine the personal information with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA.

EverXCloud complies with the obligations applicable to it under the CCPA and provides the same level of privacy protection as is required by the CCPA. It notifies the Customer if it determines that it can no longer meet its obligations. The Customer may take reasonable and appropriate steps, in accordance with Section 13, to ensure that EverXCloud uses the personal information in a manner consistent with the Customer's obligations, and, upon notice, to stop and remediate unauthorised use. EverXCloud certifies that it understands and will comply with the restrictions of this Section.

16. Liability

Each party's liability arising out of or related to this DPA, including the SCCs to the extent permitted by them, is subject to the exclusions and limitations of liability set out in the Terms of Service, which apply in the aggregate to all claims under the Terms of Service and this DPA. Nothing in this Section limits the rights of data subjects under the SCCs or any liability that cannot be limited under applicable law.

17. Term, precedence and changes

This DPA remains in force for as long as EverXCloud processes Customer Personal Data on behalf of the Customer.

In case of conflict, the following order of precedence applies: the SCCs and the UK Addendum, where applicable; then this DPA; then the Terms of Service and the other policies they incorporate. This DPA prevails over the Terms of Service for all matters relating to the processing of Customer Personal Data.

EverXCloud may amend this DPA where required by a change in Data Protection Laws, a decision of a supervisory authority or court, or a change in the Services that does not materially reduce the protection of Customer Personal Data, by publishing the updated version and notifying the Customer at least 30 days in advance. This DPA is governed by the law that governs the Terms of Service, except for the SCCs and the UK Addendum, which are governed by the law stated in them.

Effective date: 19 October 2026. Version 2026-10-19.