Data Processing Agreement

1. Parties and roles

1.1. The Customer (the company holding the MorDitor account) is the controller and MORDELABS CORP, LDA, a Portuguese company with tax number (NIF) 518346897, registered office at Av. Visconde de Barreiros, 358, 4.º Dto. Frente, 4470-139 Maia, Portugal ("MORDELABS") is the processor. Capitalised terms have the meaning given in the Terms and Conditions and in the GDPR.

1.2. Where the Customer processes the data on behalf of its End Customers (who are then the controllers), the Customer acts as their processor and MORDELABS as a sub-processor. In that case, the Customer warrants that its End Customers have authorised the engagement of MORDELABS and that the instructions given to MORDELABS reflect theirs; this Agreement applies mutatis mutandis, and the Customer is MORDELABS' sole point of contact.

1.3. The Customer's and Users' account and billing data are not covered: MORDELABS processes them as controller, as described in the Privacy Policy.

2. Subject matter and instructions

2.1. The subject matter, duration, nature and purpose of the processing and the categories of data and data subjects are set out in Annex I.

2.2. MORDELABS processes the data only on the Customer's documented instructions, which are: the Terms and Conditions, this Agreement, and the configuration and use of the Service by the Customer and its Users (for example, installing the Agent, configuring groups and thresholds, requesting remote actions, exporting or deleting data). Additional instructions must be given in writing and be compatible with the Service.

2.3. MORDELABS informs the Customer if it considers that an instruction infringes the GDPR or other data protection law. If it is required by law to process the data otherwise, it informs the Customer beforehand, unless the law prohibits it.

2.4. MORDELABS does not use the data for its own purposes, does not sell it and does not disclose it to third parties, except to sub-processors under section 5 or where required by law.

3. Confidentiality

MORDELABS ensures that persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality, and that they only access the data as needed (support requested by the Customer, maintenance, security). Such access is logged.

4. Security

MORDELABS applies the technical and organisational measures in Annex III, appropriate to the risk under article 32 GDPR. It may update them provided the level of protection does not decrease.

5. Sub-processors

5.1. The Customer gives general authorisation for MORDELABS to engage sub-processors. The current ones are listed in Annex II.

5.2. MORDELABS informs the Customer, by e-mail to the Owners and by updating Annex II, of any new or replacement sub-processor at least 30 days in advance. The Customer may object in writing, on reasonable data protection grounds, within that period. If the parties cannot find a solution, the Customer may terminate the contract before the change and receives a credit note pro rata to the unused period of its paid Licences.

5.3. MORDELABS imposes on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement and remains liable to the Customer for their performance.

6. International transfers

Data is hosted in the European Union. It is only transferred outside the European Economic Area in the cases listed in Annex II and on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or of standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, with appropriate supplementary measures.

7. Assistance to the Customer

7.1. The Service gives the Customer tools to answer data subject requests: company data export, inventory export, download of a User's personal data, User anonymisation, machine removal (which deletes the Agent's local data) and account closure. If a data subject contacts MORDELABS directly, MORDELABS forwards the request to the Customer without answering it, unless instructed otherwise.

7.2. MORDELABS also provides reasonable assistance to the Customer with the security of processing, data protection impact assessments and prior consultations with the supervisory authority, taking into account the nature of the processing and the information available to it. Assistance beyond the Service tools and the information in this Agreement may be charged at reasonable rates, upon a prior quote.

8. Personal data breaches

MORDELABS notifies the Customer, by e-mail to the Owners, without undue delay and, where possible, within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notification includes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and is supplemented as more information becomes available. Notifying the supervisory authority and the data subjects is the Customer's responsibility.

9. Retention, return and deletion

9.1. During the contract, data is retained for the periods in Annex I, which the Customer accepts as part of its instructions.

9.2. At the end of the contract, the Customer can export the data during the 30-day closure period. After that period, MORDELABS deletes the Customer Data unless the law requires it to be kept; the machines receive the signed order to remove the Agent, which deletes its local data. Data in encrypted backups is overwritten in the normal rotation cycle (up to 12 months) and is not used until then except for disaster recovery. MORDELABS confirms deletion in writing if the Customer so requests.

10. Information and audits

10.1. MORDELABS makes available to the Customer the information necessary to demonstrate compliance with article 28 GDPR, including this Agreement, its annexes and, where applicable, its sub-processors' certifications (for example, the ISO/IEC 27001 certification of Hetzner's data centres).

10.2. If that information is not sufficient, the Customer may carry out or commission an audit, at most once a year (except after a data breach or when required by an authority), with 30 days' notice, on business days, without disrupting the Service or accessing other customers' data, by an auditor bound by confidentiality who is not a competitor of MORDELABS. The Customer bears the costs of the audit.

11. Customer obligations

The Customer, as controller (or towards its End Customers), is responsible for:

• having a lawful basis for the processing and informing data subjects (articles 13 and 14 GDPR), in particular the End Users of the monitored machines;
• complying with the rules on employee monitoring and remote surveillance (articles 20 to 22 of the Portuguese Labour Code and CNPD guidance, or equivalent local rules), and carrying out an impact assessment where required;
• collecting only the necessary data, using the Service options (for example, turning off security events or account alerts in a group);
• not putting special categories of data or children's data into the Service, unless strictly necessary and lawful;
• ensuring that its instructions are lawful and answering data subject requests.

12. Liability and final provisions

12.1. The parties' liability is governed by article 82 GDPR and by the Terms and Conditions, including the limitation of liability, to the extent permitted by law.

12.2. This Agreement remains in force while MORDELABS processes Customer Data. On data protection matters it prevails over the Terms and Conditions. It is governed by Portuguese law, and the courts of the district (comarca) of Porto have jurisdiction. Changes follow section 24 of the Terms and Conditions.

Annex I — Description of the processing

Annex II — Sub-processors

Sub-processors that process Customer Data:

For transparency: Stripe (payments) and Vendus (invoicing) only process the Customer's billing data, for which MORDELABS is controller, and do not receive Customer Data. VAT number checks in VIES (European Commission) only send the Customer's country and VAT number.

Annex III — Technical and organisational measures

• Encryption in transit: all communication between the Agent, the portal, the app and the API uses HTTPS/TLS with valid certificates; HSTS on the portal and the website.
• Encryption at rest: machine secrets, protection codes and two-factor secrets encrypted (AES-256-GCM); backups encrypted before leaving the server.
• Authentication: passwords hashed with argon2id; lockout after failed attempts; two-factor authentication (TOTP), mandatory for MORDELABS staff and configurable as mandatory by the Customer; rotating, revocable sessions.
• Isolation: every query is filtered by the Customer's account and by the groups each User can access; a request for another account's data is refused as non-existent.
• Agent: each machine has its own key and signs its requests; remote actions are a closed list, restricted to authorised roles; updates and the removal order are digitally signed by MORDELABS and verified by the Agent; protection against unauthorised uninstallation.
• Activity log of relevant actions (sign-ins, changes, remote actions, exports, access by MORDELABS staff).
• Availability and recovery: daily database backups, with an encrypted off-server copy, rotation (daily, weekly and monthly, up to 12 months) and restore tests; platform monitoring.
• Infrastructure: servers in the European Union, in ISO/IEC 27001-certified data centres; administrative access restricted by key and network; separate MORDELABS administration portal with limited access; regular security updates.
• Minimisation: the Agent does not collect files, e-mails, browsing, keystrokes or screen; process and service lists are not stored; retention periods with automatic deletion.
• Organisation: data access only by the necessary staff, bound by confidentiality; incident response and breach notification procedure; data processing agreements with sub-processors.