Data Processing Agreement.

Terms like 'personal data', 'processing', 'controller', 'processor', and 'data subject' have the meaning given to them by the General Data Protection Regulation (GDPR).

REL processes personal data solely to execute the engagement described in the SOW. The DPA runs for the duration of the SOW. Obligations around deletion and confidentiality survive termination.

Processing consists of reading, analysing, and reporting on configuration and usage data within the engagement scope. For the assessment, access is read-only. For remediation, temporary write access within the package scope is permitted.

Processing covers the following categories of data and data subjects.

• Identity data from Entra ID (UPN, display name, email, role assignments).
• Sign-in and audit log metadata.
• Usage data from Microsoft 365 (licence assignment, shared mailbox properties).
• No special categories of personal data, no BSN, no banking data.
• Data subjects: client employees, external users, and guest users.

REL commits to the following.

• Process only on documented instruction from the controller.
• Apply appropriate technical and organisational security measures (encryption in transit and at rest, MFA, principle of least privilege).
• Ensure confidentiality of all persons with access to personal data.
• Assist the controller with data subject requests and DPIAs.

REL uses a small set of sub-processors (including Microsoft Azure for compute and DocuSign for signatures). A current list is available on request. REL notifies the controller of changes. The controller can object with reason within 30 days.

REL reports suspected and confirmed data breaches to the controller within 24 hours of discovery, including all information the controller needs to meet its own notification duties.

The controller has the right, once per year, on reasonable notice and at its own cost, to audit (or have audited) compliance with this DPA. REL cooperates to the extent necessary without unreasonably disrupting service continuity.

After the engagement ends, all processed personal data is deleted within 30 days unless a legal retention requires otherwise. REL confirms the deletion in writing.

Personal data is processed only within the European Economic Area, unless the nature of the service makes that impossible. In that case REL applies Standard Contractual Clauses and assesses the protection level per recipient.

Liability under this DPA is part of the liability regime in the general terms and the SOW.

Dutch law applies to this DPA. Disputes are submitted to the competent court in Amsterdam.