SKYXOPS Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the SKYXOPS Subscription Agreement (the “Terms”) between SKYXOPS CORP., a Wyoming corporation, or the SKYXOPS Regional Entity that is the contracting entity under Section 2.4 of this DPA (in each case, “SKYXOPS”), and Customer. It applies automatically when Customer accepts the Terms. Customer may also request a countersigned copy. Capitalized terms not defined in this DPA have the meanings given in the Terms.

1. Definitions

1.1 “Applicable Data Protection Laws” means all laws on data protection and privacy that apply to the processing of Customer Personal Data under the Agreement, which may include: the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as incorporated into UK law and the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection (“FADP”); the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (“CCPA”) and other US state privacy laws; India’s Digital Personal Data Protection Act, 2023; and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

1.2 “Customer Personal Data” means Personal Data contained in Customer Data that SKYXOPS processes on behalf of Customer under the Agreement, including the Authorized User account details and activity logs described in Section 2.2.

1.3 “Personal Data” means any information relating to an identified or identifiable natural person, or any information defined as personal data or personal information under Applicable Data Protection Laws.

1.4 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by SKYXOPS or its Subprocessors.

1.5 “Subprocessor” means any third party, including an Affiliate of SKYXOPS or a SKYXOPS Regional Entity, that SKYXOPS engages to process Customer Personal Data.

1.6 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

1.7 “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, version B1.0, as amended or replaced.

1.8 “Security Incident” has the meaning given in Section 10.6 of the Terms: unauthorized access to, or disclosure, alteration or loss of, Customer Data or the credentials Customer uses to connect its Connected Accounts, and any Personal Data Breach.

The terms “controller”, “processor”, “data subject”, “processing” and “supervisory authority” have the meanings given in the GDPR, and equivalent terms under other Applicable Data Protection Laws have corresponding meanings.

2. Roles and Scope

2.1 Roles. Customer is the controller of Customer Personal Data, or a processor acting for its own controllers. SKYXOPS is Customer’s processor, or subprocessor where Customer is a processor. For the CCPA, SKYXOPS is Customer’s service provider.

2.2 SKYXOPS as controller. SKYXOPS is an independent controller of the business contact and billing details of Customer’s personnel that it uses to manage Customer’s account relationship, billing and support, and processes that data under its Privacy Policy. This DPA does not apply to that use. Authorized User account details and activity logs that SKYXOPS processes to provide the Service are Customer Personal Data under this DPA.

2.3 Details of processing. Annex I describes the subject matter, nature, purpose and duration of the processing, and the types of Personal Data and categories of data subjects.

2.4 Regional contracting entities. Where a SKYXOPS Regional Entity is the contracting entity under Section 2.5 of the Terms, that SKYXOPS Regional Entity is the processor and the party to this DPA in place of SKYXOPS CORP., and SKYXOPS CORP. is its Subprocessor. References to SKYXOPS in this DPA are then read as references to that SKYXOPS Regional Entity. A SKYXOPS entity listed in Annex III is a Subprocessor only where it is not the contracting entity.

2.5 Data minimization. The Service is designed to process cloud and AI infrastructure metadata, costs and usage metrics from Cloud Provider billing data and logs and from connected source code repositories and delivery pipelines, as described in Annex I, not the content of Customer’s workloads, databases, storage or business records. Customer will not provide special categories of personal data or other data excluded by Section 10.8 of the Terms, and should not place Personal Data in resource names or tags.

3. Customer Instructions

3.1 Instructions. SKYXOPS will process Customer Personal Data only on Customer’s documented instructions. The Agreement, including Customer’s configuration and use of the Service, is Customer’s complete set of instructions at the time the Agreement is entered into. Additional instructions require the agreement of both parties. SKYXOPS may process Customer Personal Data otherwise only where required by law that applies to it, in which case SKYXOPS will inform Customer of that legal requirement before processing, unless the law prohibits this.

3.2 Unlawful instructions. SKYXOPS will inform Customer if, in its opinion, an instruction breaches Applicable Data Protection Laws. SKYXOPS need not follow such an instruction.

3.3 Customer obligations. Customer is responsible for the lawfulness of its instructions and for having a lawful basis, and any notices and consents required, for SKYXOPS’s processing of Customer Personal Data under the Agreement.

3.4 Aggregated Data. Customer instructs SKYXOPS to de-identify and aggregate Customer Data to create Aggregated Data under Section 10.3 of the Terms, including for benchmarking. SKYXOPS will use Customer Data in Aggregated Data only in combination with data of at least 5 customers, and Aggregated Data will never reveal the identity of Customer or any individual, or Customer’s negotiated pricing or discounts with any Cloud Provider.

4. SKYXOPS Obligations

4.1 Confidentiality. SKYXOPS will ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality.

4.2 Security. SKYXOPS will implement and maintain the technical and organizational measures described in Annex II. SKYXOPS may update those measures, but will not materially reduce the overall level of protection during a Subscription Term.

4.3 CCPA. SKYXOPS will not: (a) sell or share Customer Personal Data, as those terms are defined in the CCPA; (b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties; or (c) combine Customer Personal Data with personal information it receives from other sources, except as the CCPA permits, including to create de-identified information. SKYXOPS will notify Customer if it determines that it can no longer meet its obligations under the CCPA. SKYXOPS certifies that it understands these restrictions.

4.4 No model training. SKYXOPS will not use Customer Personal Data to train or fine-tune any machine learning or AI model, as stated in Section 6.1 of the Terms.

5. Subprocessors

5.1 Authorization. Customer gives SKYXOPS general authorization to engage Subprocessors. Annex III lists the Subprocessors authorized on the date of this DPA.

5.2 Subprocessor obligations. SKYXOPS will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA. SKYXOPS remains responsible for each Subprocessor’s performance.

5.3 Notice of changes. SKYXOPS will publish its current Subprocessor list at skyxops.com/legal/subprocessors and will notify Customer of any intended addition or replacement of a Subprocessor at least 30 days before the change takes effect. SKYXOPS will send these notices by email to Customer’s contact for notices stated in the Order Form or, if none is stated, to the email address associated with Customer’s account. Customer may add recipients by email to privacy@skyxops.com.

5.4 Objection. Customer may object to a new Subprocessor on reasonable grounds relating to data protection by written notice within 30 days after SKYXOPS’s notice. The parties will discuss the objection in good faith. If SKYXOPS cannot address the objection within 30 days after receiving it, Customer may terminate the affected part of the Service by written notice, and SKYXOPS will refund the prepaid Fees for the unused part of the Subscription Term for that part of the Service, as provided in Section 13.6 of the Terms. The refund excludes one-time fees and is limited to the amounts SKYXOPS received for that part of the Service.

6. International Transfers

6.1 Transfer locations. SKYXOPS hosts Customer Data on Amazon Web Services in one AWS region chosen by Customer from those listed in Annex III and stated in the Order Form or selected at sign-up. SKYXOPS will not move Customer Data to another hosting region without Customer’s written consent, except that Customer Data submitted to the AI Features may be processed in another AWS region listed in Annex III where the selected AI model is not offered in Customer’s region. SKYXOPS and its Subprocessors may access and process Customer Personal Data in the United States, India, the United Arab Emirates and any other country listed in Annex III, subject to this Section 6.

6.2 Transfers from the EEA. Where Customer transfers Customer Personal Data subject to the GDPR to SKYXOPS in a country that has not been recognized as providing an adequate level of protection, the SCCs are incorporated into this DPA as follows: (a) Module Two applies where Customer is a controller, and Module Three applies where Customer is a processor; (b) Clause 7 (docking clause) applies; (c) under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in Section 5.3 of this DPA; (d) the optional wording in Clause 11(a) does not apply; (e) under Clause 13, the competent supervisory authority is determined as set out in Clause 13(a); (f) under Clause 17, Option 1 applies and the SCCs are governed by the laws of Ireland; (g) under Clause 18(b), disputes will be resolved before the courts of Ireland; and (h) Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.

6.3 Transfers from the United Kingdom. Where the UK GDPR applies to a transfer, the SCCs apply as amended by the UK Addendum. Tables 1 to 3 of the UK Addendum are completed with the information in Section 6.2 and Annexes I to III of this DPA. For Table 4, either party may end the UK Addendum as set out in its Section 19.

6.4 Transfers from Switzerland. Where the FADP applies to a transfer, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term “member state” does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

6.5 Onward transfers. SKYXOPS will transfer Customer Personal Data to a Subprocessor outside the country where it is hosted only under a transfer mechanism recognized by Applicable Data Protection Laws, such as the SCCs (Module Three) between SKYXOPS and the Subprocessor.

6.6 Other laws. Where other Applicable Data Protection Laws restrict international transfers, the parties will cooperate to put in place any additional transfer terms those laws require.

6.7 Government requests. If SKYXOPS receives a request from a public authority for Customer Personal Data, SKYXOPS will, unless legally prohibited, notify Customer promptly, attempt to redirect the authority to Customer, and disclose only the minimum data it is legally required to disclose after reasonably assessing the lawfulness of the request.

6.8 Data location and access. Customer Data held in the Service, including its backups, is stored only in the hosting region, except as Section 6.1 permits for the AI Features. Information that Customer sends to SKYXOPS support by email is held in the business email system listed in Annex III. SKYXOPS uses Amazon Bedrock in the hosting region wherever the selected model is offered there. Customer may switch off the AI Features, or limit them to models offered in its hosting region, in its settings, and while either setting is on, SKYXOPS will not process Customer Data for the AI Features outside the hosting region. Personnel of SKYXOPS and of the SKYXOPS entities listed in Annex III outside the hosting region, including in India and the United Arab Emirates, access Customer Data remotely, only as needed for support, engineering and operations, through SKYXOPS-controlled systems with multi-factor authentication and access logging.

6.9 Transfers from the DIFC and ADGM. Where the DIFC Data Protection Law, DIFC Law No. 5 of 2020, or the ADGM Data Protection Regulations 2021 apply to a transfer of Customer Personal Data to a jurisdiction not recognized as adequate under that law, the standard contractual clauses issued by the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection, as applicable, are incorporated into this DPA, with Customer as data exporter and SKYXOPS as data importer, and Annexes I to III of this DPA complete their annexes.

7. Security Incidents and Personal Data Breaches

7.1 Notice. SKYXOPS will notify Customer of a Security Incident, including any Personal Data Breach, without undue delay, and in any event within 72 hours after becoming aware of it. SKYXOPS becomes aware of a Security Incident when it has a reasonable degree of certainty that one has occurred. SKYXOPS will send the notice to the security contact and the contact for notices stated in the Order Form or, if none is stated, to the email address associated with Customer’s account.

7.2 Content. The notice will describe, to the extent known: the nature of the Security Incident; for a Personal Data Breach, the categories and approximate number of data subjects and records concerned; the likely consequences; any credentials Customer should rotate or revoke; and the measures taken or proposed to address it. SKYXOPS will provide further information as it becomes available.

7.3 Response. SKYXOPS will take reasonable steps to contain, investigate and remedy the Security Incident and will provide reasonable assistance to Customer in meeting its obligations to notify supervisory authorities and data subjects.

7.4 No admission. SKYXOPS’s notice of a Security Incident is not an admission of fault or liability.

7.5 India. SKYXOPS will make any report of a cyber security incident to the Indian Computer Emergency Response Team (CERT-In) that Indian law requires of it, within the time that law requires. Such a report does not delay SKYXOPS’s notice to Customer under Section 7.1.

8. Assistance

8.1 Data subject requests. Taking into account the nature of the processing, SKYXOPS will provide reasonable assistance to Customer in responding to requests from data subjects to exercise their rights. If SKYXOPS receives a request directly, it will refer the data subject to Customer and will not respond except to confirm the referral.

8.2 Security and impact assessments. Taking into account the nature of the processing and the information available to it, SKYXOPS will assist Customer in meeting its obligations on security of processing, and will provide reasonable information to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities that relate to the Service.

9. Audits

9.1 Information. SKYXOPS will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA. SKYXOPS will do so first by providing, on request and under confidentiality obligations, completed security questionnaires and any independent audit reports or certifications that SKYXOPS holds at the time. This information will include SKYXOPS’s completed industry-standard security questionnaire (such as the HECVAT or CAIQ), a summary letter from its most recent third-party penetration test and, once issued, its SOC 2 Type II report or ISO 27001 certificate. This information is sufficient to demonstrate compliance unless Customer reasonably identifies a specific gap in writing.

9.2 Audits. If that information is not sufficient to demonstrate compliance because Customer has identified a specific gap under Section 9.1, or if a supervisory authority requires it, or following a Personal Data Breach, Customer may conduct an audit, no more than once in any 12-month period except where a supervisory authority requires otherwise. Customer will give at least 30 days’ written notice, agree the scope with SKYXOPS in advance, use an auditor that is not a competitor of SKYXOPS and is bound by confidentiality obligations, conduct the audit during business hours without unreasonable disruption, and bear its own costs. Audits will be conducted remotely unless a remote audit cannot reasonably meet their purpose, and will last no more than 2 business days. Unless the audit finds a material breach of this DPA, Customer will also reimburse SKYXOPS’s reasonable costs for time its personnel spend on the audit beyond one business day.

10. Return and Deletion

Customer may have Customer Personal Data returned by exporting Customer Data in CSV format using the Service’s export features until its access to the Service ends or, for 30 days after termination or expiry, by asking SKYXOPS support for an export, which SKYXOPS will provide within 3 business days after the request, in each case as described in Section 13.7 of the Terms. At the end of that 30-day period, or once SKYXOPS has provided an export requested during it if that is later, SKYXOPS will delete Customer Personal Data from the Service. If Customer signs an Order Form or buys a paid subscription before that deletion, SKYXOPS will keep Customer Personal Data for the new subscription, as described in Section 7.1 of the Terms and the Pilot Order Form, and this Section 10 applies when that subscription ends. Copies held in backups are deleted as those backups expire, and SKYXOPS will not retain Customer Personal Data more than 45 days after that deletion, except in each case where applicable law requires retention. Retained data and backup copies remain protected under this DPA until deleted. SKYXOPS will confirm deletion in writing on request.

11. Liability and Precedence

11.1 Liability. Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This does not limit either party’s liability to data subjects under the SCCs to the extent such limitation is not permitted.

11.2 Precedence. If this DPA conflicts with the Terms, this DPA prevails for matters relating to the processing of Customer Personal Data. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

11.3 Duration. This DPA remains in effect for as long as SKYXOPS processes Customer Personal Data.

Optional Countersignature

This DPA forms part of the Agreement when Customer signs an Order Form or accepts the Terms online. No signature is needed. A customer that wants a countersigned copy can ask privacy@skyxops.com.

Annex I. Details of Processing

A. Parties

B. Description of processing

C. Competent supervisory authority

As determined under Clause 13 of the SCCs.

Annex II. Technical and Organizational Security Measures

Annex III. Authorized Subprocessors