Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms an integral part of the Terms & Conditions between Domani Equestrian BV ("Equi Assist", "we", "the Processor") and the customer using the Equi Assist Service ("the Controller", "you").

It applies whenever Equi Assist processes personal data on your behalf in the course of providing the Service. Where you and Equi Assist each act as independent controllers (e.g. for billing data, account login data), the Privacy Policy applies instead of this DPA.

2. Subject matter, nature and duration

Subject matter: processing of personal data necessary for delivering the Equi Assist Service (horse listings ingest, AI matching, client communication, sharing of horse profiles).

Duration: this DPA remains in force as long as Equi Assist processes personal data on your behalf, i.e. for the term of your subscription plus any retention period set out in the Privacy Policy.

Nature and purpose: automated and assisted processing of WhatsApp messages, emails and uploaded media to extract structured horse and contact data, match it against client search profiles, and route notifications.

3. Types of personal data and categories of data subjects

Categories of personal data processed include:

• Identification data of your contacts (name, phone number, email address)
• Communication content (WhatsApp / email message text and media)
• Search preferences and client profile data you enter
• Activity data linked to your team members (logins, actions in the app)

Categories of data subjects: your contacts (sellers, buyers, colleagues), your team members and any other natural persons whose data you choose to enter into the Service.

4. Obligations of the processor

Equi Assist will:

• process personal data only on your documented instructions, including transfers, unless required by EU or Member State law;
• ensure that persons authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational security measures (see section 7);
• assist you in fulfilling your obligations to respond to data subject rights requests, breach notifications, DPIAs and prior consultations;
• make available all information necessary to demonstrate compliance with Article 28 GDPR.

5. Sub-processors

You give Equi Assist general written authorisation to engage sub-processors to perform parts of the processing. The current named list of sub-processors - including each provider's role, processing location and applicable safeguards - is shared with you on request as the sub-processor annex to this DPA. Email info@equi-assist.com to obtain the latest version.

Equi Assist will give you at least 30 days' written notice (by email to the address on file under the DPA) before adding or replacing a sub-processor that processes your personal data, except in cases of urgent security or operational necessity, giving you the opportunity to object on reasonable grounds. If you object and we cannot resolve your concern, you may terminate the affected part of the Service.

Equi Assist imposes data protection obligations on each sub-processor that are no less protective than those set out in this DPA, by means of a written contract.

6. International data transfers

Some sub-processors are located outside the European Economic Area (notably Anthropic and Cloudflare in the United States). Such transfers take place under appropriate safeguards within the meaning of Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, supplementary technical and organisational measures.

7. Security measures

Equi Assist implements the following technical and organisational measures, taking into account the state of the art and the risk for data subjects:

• encryption of data in transit (TLS 1.2+) and at rest for primary databases and backups;
• role-based access control with least-privilege defaults; access to production data limited to a small group of authorised engineers;
• multi-factor authentication for administrative access;
• automated daily backups with monitored retention and tested restore procedures;
• centralised application and infrastructure logging with anomaly detection;
• secure software development lifecycle, including code review, dependency scanning and pre-deployment testing;
• documented incident response procedures and a defined chain of responsibility.

8. Assistance with data subject rights

Taking into account the nature of the processing, Equi Assist will assist you by appropriate technical and organisational measures, in fulfilling your obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

9. Personal data breach notification

Equi Assist will notify you without undue delay, and in any event within 72 hours after becoming aware of a personal data breach affecting your data, providing the information required under Article 33(3) GDPR to the extent it is available.

10. Audits

Equi Assist will make available to you the information necessary to demonstrate compliance with Article 28 GDPR. On reasonable prior written request, and subject to a confidentiality undertaking, Equi Assist will allow for and contribute to audits, including inspections, conducted by you or an independent auditor mandated by you, at your expense and during normal business hours, in a way that does not unreasonably interfere with the operation of the Service.

11. Return or deletion of personal data

On termination of the Service, Equi Assist will, at your choice, delete or return all personal data processed on your behalf, and delete existing copies, unless storage is required by EU or Member State law. The default behaviour, absent instructions, is deletion within 30 days after termination, in accordance with the retention periods set out in the Privacy Policy.

12. Liability and order of precedence

Each party's liability under this DPA is governed by the limitations of liability set out in the Terms & Conditions, except where mandatory law provides otherwise. In case of conflict between this DPA and the Terms & Conditions on matters of personal data protection, this DPA prevails.

13. Contact

Questions regarding this DPA can be sent to info@equi-assist.com. Belgian law applies; the courts of the judicial district of Limburg, Belgium have exclusive jurisdiction.