Finout Data Processing Agreement

FINOUT DATA PROCESSING AGREEMENT

Last revised: October 21st, 2026

This Data Processing Agreement and its annexes (together, the “DPA”) is incorporated into the Order Form, Terms of Use or the Subscription Agreement (or other electronic or mutually executed written agreement) between Finout (“Company”) and Customer that reference it (the “Agreement”). This DPA is effective as of the effective date of the Agreement.

1. 1. Definitions

1.1. "Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

1.2. “Applicable Laws” means (a) EU or Member State laws addressing any Customer Personal Data in respect of which Customer is subject to EU Data Protection Laws; and (b) any other applicable law addressing any Customer Personal Data in respect of which the Customer is subject to any other Data Protection Laws.

1.3. “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et seq., as amended by the California Privacy Rights Act of 2020, and includes all CCPA regulations.    

1. 1.4. “Customer Personal Data” means any Personal Data or Personal Information Processed by Company on behalf of Customer in connection with the Agreement.
2.  
3. 1.5. “Data Protection Laws” means (a) EU Data Protection Laws; (b) the UK GDPR; (c) the FADP; (d) the CCPA; and (e) to the extent applicable, the data protection or privacy laws of the United States, Israel and any other country agreed in writing between the Parties.
4.  
5. 1.6. “EEA” means the European Economic Area, which includes all EU Member States, Iceland, Liechtenstein and Norway.
6.  
7. 1.7. “EU” means the European Union and its member states (each a “Member State”).
8.  
9. 1.8. “EU Data Protection Laws” means the GDPR and any laws of the EU or its Member States implementing or supplementing the GDPR, in each case as amended, replaced or superseded from time to time.
10.  
11. 1.9. “EU SCC” or “EU Standard Contractual Clauses” mean the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, incorporating the Relevant Amendments. Upon the European Commission’s adoption of revised standard contractual clauses, references in this DPA to the EU SCC shall refer to the revised version, and the Parties shall cooperate in good faith to make any amendments to this DPA (including the Relevant Amendments) required to give effect to them.
12.  
13. 1.10. “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances, and “FDPIC” means the Swiss Federal Data Protection and Information Commissioner.
14.  
15. 1.11. “GDPR” means EU General Data Protection Regulation 2016/679 and any subsequent amendments, replacements or supplements.
16.  
17. 1.12. “Relevant Amendments” means the amendments to the EU SCC, the UK Addendum, and the Swiss Addendum identified under Annex 2.
18.  
19. 1.13. “Subprocessor” means any third party (including any Company Affiliate but excluding an employee of Company or any of its sub-contractors) appointed by or on behalf of Company or any Company Affiliate to Process Customer Personal Data.
20. “Standard Contractual Clauses” or “SCCs” means the EU SCC, the UK Addendum and the Swiss Addendum, as applicable.
21.  
1. 1.14.“Swiss Addendum” means the adaptations to the EU SCC required for transfers subject to the FADP, as set out in Section C of Annex 2.
2. 
   1.15. “UK Addendum” means the International Data Transfer Addendum to the EU SCC issued by the UK Information Commissioner’s Office (version B1.0, in force 21 March 2022).
3. 
   1.16. “UK GDPR” means the United Kingdom’s Data Protection Act 2018 and the GDPR as adapted into law of the United Kingdom by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018.
4. 
   1.17. The terms “Data Subject”, “Personal Data”, “Personal Data Breach”, “Special Categories of Data”, “Process/Processing”, “Controller”, “Processor”, “Supervisory Authority” and “Third Country” have the meanings given to them in the GDPR, and the terms “Business”, “Business Purpose”, “Consumer”, “Contractor”, “Service Provider”, “Sale”, “Sell” and “Personal Information” have the meanings given to them in the CCPA. References to any law include that law as amended, replaced or superseded from time to time. 
5.  

1. 2. Processing of Customer Personal Data
2. 
   
   1. 2.1. This DPA applies only to Personal Data obtained by Company as a result of Customer’s use of Company’s Services, as described in Annex 1 (which sets out the details of the Processing required by Article 28(3) of the GDPR). As between the Parties, Company shall Process Customer Personal Data solely as a Processor on behalf of Customer, as Controller.
   2.  
   3. 2.2. Company shall Process Customer Personal Data only on Customer’s documented reasonable and customary instructions as specified in the Agreement or this DPA, or as otherwise explicitly agreed by Company, unless required by Applicable Laws, in which case Company shall inform Customer of such legal requirement before Processing unless such law prohibits it on public interest grounds.
   4.  
   5. 2.3. Customer instructs Company (and authorizes Company to instruct each Subprocessor) to Process Customer Personal Data, including by transferring it to any country or territory, only as reasonably necessary for the provision of the Services and in accordance with Sections ‎2.1-‎2.2, Section ‎13, the Agreement and Applicable Laws.
   6.  
   7. 2.4. Customer warrants and represents that it is and will remain duly authorized, on behalf of itself and each relevant Customer Affiliate, to give the instructions set out in Section 2.3 and any other instructions under the Agreement for as long as Company Processes Customer Personal Data, and that it has made all notices and obtained all consents, authorizations and approvals required for Company to Process Customer Personal Data as permitted hereunder.
   8.  
   9. 1. 3. CCPA Standard of Care; No Sale of Personal Information

   10. Company does not receive Personal Information as consideration for the Services. Company shall not Sell Personal Information Processed hereunder and shall retain, use and disclose it solely for the purposes for which it was provided to Company under the Agreement and this DPA. Company certifies that it understands and will comply with the restrictions in this Section 3.

       1. 4. Customer Obligations

   11. Customer shall comply with all applicable laws (including Data Protection Laws) in connection with this DPA and, as between the Parties, shall be solely responsible for the lawfulness of the collection and transfer of Customer Personal Data to Company. Customer shall not provide Company with any special categories of data, as defined in Article 9 of the GDPR, or similarly sensitive Personal Data.

       1. 5. Company Personnel

       Company shall take reasonable steps to ensure that access to Customer Personal Data is limited on a need-to-know basis to personnel who are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access/use of Customer Personal Data.

       1. 6. Security

       Company shall implement the technical and organizational measures set out in Annex 3, which are designed to ensure a level of security appropriate to the risk in accordance with Article 32 of the GDPR. In assessing the appropriate level of security, Company shall consider the risks presented by Processing, in particular from a Personal Data Breach.

       1. 7. Subprocessing
       2.  
       3. 7.1. Customer authorizes Company and each Company Affiliate to appoint Subprocessors (and to permit Subprocessors to appoint further Subprocessors) in accordance with this Section ‎‎7 and the Agreement.

   12. 7.2. “Company and each Company Affiliate may continue to use the Subprocessors listed at https://www.finout.io/sub-processor as of the date of this DPA, as well as any Subprocessors whom Customer requested Company to use. 
       

       7.3. Company shall give Customer prior notice (e.g., by e-mail) of the appointment of any new Subprocessor, including relevant details of the Processing to be undertaken by it. If Customer notifies Company in writing of any reasonable objections within seven (7) days of such notice, Company shall not appoint the proposed Subprocessor to Process Customer Personal Data until reasonable steps have been taken to address the objections and Customer has been provided with a reasonable written explanation of the steps taken. If such steps do not resolve Customer’s reasonable objections, either Party may, by written notice to the other Party with immediate effect, terminate the Agreement to the extent it relates to the Services which require the use of the proposed Subprocessor, without liability for such termination. Otherwise, Customer shall be deemed to have accepted such appointment.
       

       1. 1. 7.4. With respect to each new Subprocessor, Company shall:
             
       2.         
       3.         7.4.1  take reasonable steps before the Subprocessor first Processes Customer Personal Data to ensure that it is committed to providing the level of protection for Customer Personal Data required by the Agreement;
       4.  
       5.         7.4.2  require the Subprocessor to be bound by a written contract offering a materially similar level of protection for Customer Personal Data as this DPA and meeting the requirements of Data Protection Laws; and
          
       6.  
   13.         7.4.3 remain fully liable to Customer for the Subprocessor’s Processing of Customer Personal Data.
       
       1. 
          
          1. 8. Data Subject Rights
             
          2.  
          3. 8.1. Customer shall be solely responsible for responding to requests to exercise Data Subject rights under Data Protection Laws. Taking into account the nature of the Processing, Company shall reasonably assist Customer, insofar as feasible and at Customer’s sole expense, in fulfilling such obligations. 
             

       2. 8.2. Unless prohibited by Applicable Laws, Company shall promptly notify Customer if it receives a request from a Data Subject in respect of Customer Personal Data, and shall not respond to that request except on Customer’s documented instructions or as required by Applicable Laws (in which case Section 2.2 shall apply).
          

          1. 9. Personal Data Breach
             
          2.  
          3. 9.1. Company shall notify Customer without undue delay upon becoming aware of a Personal Data Breach affecting Customer Personal Data Processed by Company or its Affiliates, and shall provide Customer with information in Company’s possession to assist Customer in meeting any obligations to notify Data Subjects or Supervisory Authorities under Data Protection Laws.
             

       3. 9.2. At Customer’s written request and sole expense, Company shall reasonably cooperate with Customer and take such commercially reasonable steps as are agreed by the Parties or required under Data Protection Laws to assist in the investigation, mitigation and remediation of such Personal Data Breach. 
          

       4. 10. Data Protection Impact Assessment and Prior Consultation
          

       5. At Customer’s written request and expense, Company shall provide reasonable assistance to Customer, at Customer's expense, with any data protection impact assessments or prior consultations with Supervisory Authorities required under Data Protection Laws, solely in relation to Company’s Processing of Customer Personal Data.

          1. 11. Deletion or return of Customer Personal Data
             
          2. 
             11.1. Subject to Section ‎11.2, Company shall, no later than sixty (60) days after cessation of the Services involving the Processing of Customer Personal Data, delete or pseudonymize all copies of such Customer Personal Data.
             

1. 1. 1. 11.2. Subject to the Agreement, Company may retain Customer Personal Data to the extent authorized or required by applicable laws, provided that Company shall ensure its confidentiality and only Process it for such legal purpose(s). 
         

      2. 11.3. Upon Customer’s prior written request, Company shall provide written certification to Customer that it has complied with this Section ‎11.
         
      3. 
         
         1. 1. 1. 1. 12. Audit Rights
                  2.  
                  3. 12.1. Upon Customer’s prior written request, subject to Sections ‎‎12.2 and ‎‎12.3 and only to the extent required under Data Protection Laws, Company shall make available to a reputable independent auditor mandated by Customer and bound by confidentiality obligations the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits, including inspections, by such auditor of Company’s Processing of Customer Personal Data. Company may satisfy such request by providing its then-current SOC 2 Type 2 report and ISO 27001 certificate (or equivalent) and reasonable responses to Customer's written security questionnaires, and an audit or inspection shall take place only where such information is insufficient to demonstrate compliance under Data Protection Laws. Audits or inspections may be conducted no more than once in any twelve (12) month period, unless required by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data. 
                     

         1. 1. 1. 12.2. Information and audits under Section 12.1 shall be at Customer’s sole expense, shall only apply to the extent the Agreement does not otherwise give Customer information and audit rights meeting the requirements of Data Protection Laws, and shall be subject to the terms of the Agreement and to Company’s confidentiality obligations to third parties. 
                  

               2. 12.3. Customer shall give Company at least two (2) weeks’ prior written notice of any audit or inspection under Section ‎12.1 and shall not cause (and shall ensure that its auditors do not cause) any damage, injury or disruption to Company’s premises, equipment, personnel or business. 
                  
               3. 
                  
                  1. 1. 1. 1. 13. Restricted Transfers
                              
                           2.  
                           3. 13.1. Company shall Process Customer Personal Data within the EEA, Switzerland, the United Kingdom, the United States and/or Israel, unless otherwise approved in writing by Customer (such approval being deemed granted for the Subprocessors referred to in Section 7). Transfers of Customer Personal Data outside the EEA, Switzerland or the United Kingdom shall be carried out on the basis of the applicable Standard Contractual Clauses.
                              

                  1. 1. 1. 13.2. Where a Party subject to the GDPR transfers Personal Data to the other Party in a Third Country, the EU Standard Contractual Clauses are incorporated herein by reference and deemed duly executed between the Parties upon execution of this DPA, to the extent applicable to the transfer, as completed by Section A of Annex 2 (which sets out the roles of the Parties, the applicable modules and the information required in the Appendix to the EU Standard Contractual Clauses).
                           

                        2. 13.3. Where a Party transfers Personal Data from the United Kingdom to the other Party in a Third Country, the UK Addendum shall apply in the same manner as set out in Section 13.2, appended to the EU Standard Contractual Clauses as incorporated, and as completed by Section ‎B of Annex 2. 
                           
                        3.  
                        4. 13.4. Where a Party transfers Personal Data from Switzerland to the other Party in a Third Country, the Swiss Addendum shall apply in the same manner as set out in Section 13.2, appended to the EU Standard Contractual Clauses as so incorporated, and as completed by Section ‎C of Annex 2. 
                           
                        5. 
                           
                           1. 1. 1. 1. 14. General Terms
                                       
                                    2.  
                                    3. 14.1. Governing Law and Jurisdiction. This DPA, and any dispute or claim (including non-contractual) arising out of or in connection with it, shall be governed by the law and subject to the jurisdiction set out in the Agreement.
                                       

                           1. 1. 1. 1. 1. 14.2. Order of Precedence. Nothing in this DPA reduces Company’s obligations under the Agreement in relation to the protection of Personal Data or permits Processing prohibited by the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail solely with respect to its subject matter and solely to the extent the conflict originates from the requirements of Article 28 of the GDPR (unless otherwise agreed in writing by the Parties). In the event of any conflict between this DPA and the Standard Contractual Clauses (to the extent entered into under Section 13), the Standard Contractual Clauses shall prevail. This DPA does not limit or derogate from Customer’s own obligations and liabilities towards Company under the Agreement or applicable law in connection with the collection, use and transfer of Personal Data to Company.
                                          

                                       2. 14.3. Changes in Data Protection Laws.
                                       3.  
                                       4.       14.3.1  Customer may, by at least forty-five (45) calendar days' prior written notice to Company, request any variations to this DPA required as a result of any change in, or decision of a competent authority under, any Data Protection Law, to allow Processing of Customer Personal Data to continue without breach of that Data Protection Law. In such event: (i) Company shall make commercially reasonable efforts to accommodate such request; and (ii) Customer shall not unreasonably withhold or delay agreement to any consequential variations proposed by Company to protect it against additional risks, or to indemnify and compensate Company for any further steps and costs associated with such variations.
                                          
                                       5.  
                                       6.        14.3.2 If Customer gives notice under Section ‎14.3.1, the Parties shall promptly negotiate the proposed variations in good faith. If the Parties are unable to agree within thirty (30) days, either Party may, by written notice to the other Party with immediate effect, terminate the Agreement to the extent it relates to the Services affected by the proposed variations (or lack thereof).
                                          
                                       7.  
                                       8. 14.4. Severance. If any provision of this DPA is invalid or unenforceable, the remainder of this DPA shall remain in force, and such provision shall be (i) amended as necessary to ensure its validity and enforceability while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed as if the invalid or unenforceable part had never been contained therein.
                                          
                                       
                                       

                                       Annex 1
                                       
                                       

                                       Details of Processing of Customer Personal Data

                                       This Annex 1 sets out the details of the Processing of Customer Personal Data required by Article 28(3) GDPR.

                                       Data Exporter. Customer, as Controller.

                                       Data Importer. Company, as Processor.

                                       Subject Matter and Duration of the Processing of Customer Personal Data. The subject matter and duration of the Processing of the Customer Personal Data are set out in the Agreement.

                                       The Nature and Purpose of the Processing of Customer Personal Data: rendering Services detailed in the Agreement.

                                       The types of Customer Personal Data to be Processed are as follows: name, email, position, organization name, IP address.

                                       The categories of Data Subjects to whom the Customer Personal Data relates to are as follows: Customer’s employees, consultants, vendors.

                                       The obligations and rights of Customer. As set out in the Agreement and this DPA.

                                    2.  

                                    3.  

                                       Annex 2

Standard Contractual Clauses

1. EU Standard Contractual Clauses

For the purposes of the EU Standard Contractual Clauses, the Parties agree on the following:

• MODULE ONE and MODULE FOUR language shall be deleted.
• Clause 7 (Docking Clause) does not apply.
• For Clause 9 (Use of Subprocessors) (a) (only for MODULE TWO: Transfer controller to processor and MODULE THREE: Transfer processor to processor), Option 2 applies, with the time period set out in Section 7.3 of the DPA.
• The optional paragraph under Clause 11 (Redress) (a) does not apply.
• For Clause 17 (Governing Law) (only for MODULE TWO: Transfer controller to processor and MODULE THREE: Transfer processor to processor), Option 1 applies. The EU Standard Contractual Clauses shall be governed by the law of Ireland.
• For Clause 18 (Choice of Forum and Jurisdiction), any dispute arising from the EU Standard Contractual Clauses shall be resolved by the courts of Ireland.

The following modules of the EU Standard Contractual Clauses apply to the transfers under this DPA:

• MODULE TWO: Transfer controller to processor

• MODULE THREE: Transfer processor to processor

For the avoidance of doubt, modules not checked above do not apply to the transfers under this DPA.

1. UK Addendum
2.  

1. Swiss Addendum

To the extent a transfer under the DPA is governed by the FADP (and without amending the Standard Contractual Clauses as they apply to the processing of Personal Data under the GDPR), the following shall apply:

• the FDPIC will be the competent supervisory authority, in Annex I.C under Clause 13 of the Swiss Addendum;
• the applicable law for contractual claims and place of jurisdiction for actions between the parties under Clauses 17 and 18 of the Standard Contractual Clauses shall be as set forth in the Standard Contractual Clauses, provided that the term “member state” must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18c;
• references to the “GDPR” should be understood as references to the “FADP;” and
• where the FADP protects legal entities as data subjects, the Swiss Addendum will apply to data relating to identified or identifiable legal entities.

Annex 3

Technical and Organizational Measures

1. 1. Access Control Measures

1.1. Access rights are assigned according to the principle that employees and third-party users are only granted the level of access they need to perform their activities (i.e., the “need-to-know” principle).

1.2. Access rights are granted according to defined (role-based) permission profiles. Processor maintains proper controls for requesting, approving, granting, modifying, revoking and revalidating user access to systems and applications containing Personal Data. Access rights that are no longer required are withdrawn promptly. Access to networks and network services is restricted by technical and physical measures. Access to wireless corporate networks that allow access to Personal Data is protected by personalized authentication.

2. Physical Access Control Measures

Physical secure areas are defined on the basis of information security and data protection requirements and protected against unauthorized access through appropriate physical safeguards.

3. Encryption and Pseudonymization Measures

1. 3.1. Processor uses industry-standard, well-maintained encryption mechanisms to protect data in transit over public communication networks.
   
2.  
3. 3.2. Measures of pseudonymization are implemented to the extent necessary for the Company to uphold its obligations under the Agreement. 
   
4.  
5. 4. Protection Measures during Data Storage
6.  
7. 4.1. Processor uses industry best practices for storing information.
   
8.  
9. 5. Business Continuity Plans and Data Backup Measures
   
10.  
11. 5.1. Processor maintains a business continuity and disaster recovery plan that is consistent with standard business practices.  
    
12.  
13. 5.2. Backup data that is intended for off-site storage is encrypted prior to transport. 
    
14.  
15. 5.3. Processes or procedures for handling disruptions to Processor’s IT systems and for restoring systems after a disruption have been established to the extent required. 
    
    
1. 6. Policies and Procedures
2.  
3. Processor maintains policies and procedures (including, where permitted by applicable laws, employees background checks or background screenings) that are aimed to ensure Processor’s employees, agents, and representatives, including supplemental personnel are aware of and subject to the confidentiality and non-use obligations contained herein. Such policies and procedures may be periodically reviewed and amended. 
   
   

1. 7. System and Network Security Measures
   
2.  
3. Processor will maintain network security measures such as firewalls, remote access control via virtual private networks or remote access solutions, network segmentation, and detection of unauthorized or malicious network activity via security logging and monitoring.
4.  

1. 8. Certification
2. 
   The processor maintains its SOC 2 Type 2 and ISO 27001 certifications.

9. Regular Testing, Assessing, and Evaluating of TOMs

Processor will maintain measures meant to identify, manage, mitigate, and/or remediate vulnerabilities within their systems, networks, and facilities.