Data processing addendum

Effective date: 14 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between SunDevs (Pvt) Ltd ("Processor", "we") and the Customer ("Controller", "you"). It applies when we process personal data contained in Customer Data on your behalf. You accept it by accepting the Terms; no signature is needed. If you need a countersigned copy, email [email protected].

1. Scope and roles

You are the controller of personal data in Customer Data and we are your processor. The details of the processing are:

Subject matter	Providing SunLicense: issuing, storing, validating and revoking software licenses
Duration	For as long as you use the Service, plus the deletion periods in the Data retention policy
Nature and purpose	Storage, retrieval, matching of license keys and machine fingerprints, aggregation for dashboards, deletion
Data subjects	Your customers and end users of your software
Categories of data	Names and email addresses you attach to licenses; machine fingerprints and hostnames; validation results and times; approximate location (country, city, approximate coordinates) of validation calls
Special categories	None. You must not send special-category data (such as health or biometric data) to the Service

2. Our obligations

We will:

1. process personal data only on your documented instructions, which are these Terms, this DPA and your use of the dashboard and API, unless the law requires otherwise (in which case we tell you first, where allowed);
2. make sure everyone authorized to process the data is bound by confidentiality;
3. apply the technical and organizational measures described in Security;
4. use subprocessors only as described in section 3;
5. help you, taking into account the nature of the processing, to respond to data subjects exercising their rights, and pass on any request we receive directly;
6. help you with security, breach notification, data protection impact assessments and consultations with authorities, as far as they concern our processing;
7. delete personal data at the end of the Service as set out in the Data retention policy, unless the law requires us to keep it;
8. make available the information needed to show compliance with this DPA, and allow reasonable audits as described in section 6.

3. Subprocessors

You give general authorization for us to use the subprocessors on the Subprocessors page. We impose data protection obligations on each one that are no less protective than this DPA, and we remain responsible for their performance.

We will announce new subprocessors on that page and to the Owner's email at least 30 days before they start processing personal data. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may close your account, and that is your sole remedy.

4. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken or proposed. We will send updates as we learn more.

5. International transfers

Customer Data is processed in the United States and through Cloudflare's global network, by a processor based in Sri Lanka. Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module Two (controller to processor) and, where relevant, the UK International Data Transfer Addendum. The clauses are incorporated by reference, with the details in section 1 as their annexes and the measures in Security as Annex II. Governing law and courts for the clauses are those of Ireland.

6. Audits

On written request, no more than once a year, we will answer a reasonable security questionnaire and provide documentation of our measures. If that is not enough to show compliance, or an authority requires it, you may audit our compliance at your own cost, on 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

7. Your responsibilities

You are responsible for having a lawful basis for the processing, for giving your customers the information the law requires (for example in your privacy policy or end-user licence agreement), and for the accuracy of the data you send.

8. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses prevail.