Data Processing Agreement

Version 1.0.0 · Standard agreement for the Dyntora-hosted AZExecute service. Electronic acceptance incorporates this agreement and Annexes A–D.

1. Parties, scope and precedence

Controller: the organisation identified by legal name, registered address and company registration number in the electronic acceptance receipt. Its accepting administrator is the initial privacy contact; the customer may update this contact through info@azexecute.com.

Processor: Dyntora ApS, Danish CVR 46375599, VAT DK46375599, registered address Nørregårdsvej 232, 2610 Rødovre, Denmark, privacy and contractual contact info@azexecute.com.

This DPA forms part of the subscription agreement in the electronic acceptance receipt and covers personal data processed on the customer's behalf as described in Annex A. The customer determines its purposes and essential means; Dyntora acts as processor. If the customer is itself a processor, it must identify the controller and document authority to appoint Dyntora as subprocessor.

Each party's independent-controller processing, including its own contract administration and statutory accounting, is outside this DPA and requires its own lawful basis and transparency. Customer service data shall not be repurposed on that basis.

The GDPR and applicable Danish supplementary law apply. Mandatory law and applicable transfer clauses prevail; this DPA prevails over conflicting commercial terms on personal-data processing. Data subjects' rights and supervisory authorities' powers are unaffected.

2. Instructions and controller obligations

Dyntora shall process personal data only on documented customer instructions, including for international transfers, unless EU or Member State law requires otherwise. It shall notify the customer of such a requirement before processing unless legally prohibited on important public-interest grounds. This agreement, its annexes and authorised service settings are the initial instructions; additional instructions use Annex D's contacts.

Dyntora shall immediately notify the customer of instructions it considers unlawful and suspend the affected instruction pending resolution. It shall not sell Customer Data or use it for advertising, general-purpose AI training or unrelated product development.

The customer is responsible for lawful collection, a valid legal basis, privacy notices, accurate instructions and authorised access and integrations. Special-category and criminal-offence data require prior agreement under Annex A. Each party retains its statutory obligations.

3. Confidentiality and access

Dyntora shall bind authorised personnel to confidentiality or an appropriate statutory duty, provide relevant security instruction and limit access to what is necessary for the agreed processing. Confidentiality continues after engagement ends. Annex C governs access safeguards.

4. Security

Dyntora shall maintain the measures in Annex C and security appropriate to risk under GDPR Article 32, taking account of the processing, state of the art and implementation costs.

Measures may change without materially reducing protection. Material changes affecting the customer's risk assessment shall be communicated in advance where practicable.

5. Subprocessors

The customer gives general written authorisation for Annex B's subprocessors. Dyntora shall give at least 30 days' advance notice of additions or replacements, including their identity, services, locations, data categories and transfer safeguards. The customer may object on reasonable data protection grounds during that period.

The parties shall seek a compliant solution before an objected-to subprocessor processes that customer's data. If none is available, the customer may terminate the affected service before the change and receive a refund of unused prepaid fees.

Dyntora shall bind subprocessors to substantially the same data protection obligations, including adequate security guarantees, and remains fully liable to the customer for their performance. It shall provide processing-chain information needed to verify compliance; confidentiality restrictions must not prevent meaningful verification.

6. International transfers

Annex B identifies the provider and processing locations. Hosting and backups remain in Denmark and Sweden. Access or transfers outside the EEA require documented customer instructions, a valid GDPR Chapter V mechanism and any necessary transfer assessment and supplementary safeguards. These requirements also apply to onward transfers. This DPA alone does not authorise international transfers.

If transfer safeguards become invalid or ineffective, Dyntora shall notify the customer, suspend the affected transfer and cooperate on a lawful solution. It shall notify the customer of binding public-authority disclosure demands unless prohibited and disclose only what is legally required.

7. Assistance and individual rights

Taking account of the processing, Dyntora shall assist, through appropriate measures insofar as possible, with data-subject rights under GDPR Chapter III. It shall promptly forward requests received directly and not respond substantively without customer instructions unless legally required.

Taking account of the processing and information available, Dyntora shall assist with GDPR Articles 32–36, including security, breach notifications, impact assessments and prior consultation, in time for applicable deadlines. Fee discussions shall not delay mandatory assistance.

8. Personal data breaches

Dyntora shall notify the customer's incident contact without undue delay after becoming aware of a personal data breach affecting this processing. It shall provide available details of the breach, affected people and data, approximate numbers, likely consequences, response measures and a contact, with missing information supplied promptly in stages.

Dyntora shall investigate, contain and remediate the breach, preserve evidence and assist the customer with required notifications. The customer decides controller notifications; Dyntora retains its independent legal duties. The customer's possible 72-hour authority-notification deadline does not permit Dyntora to delay notifying it.

9. Demonstrating compliance and audits

Dyntora shall provide information needed to demonstrate compliance with Article 28 and this DPA, and allow and contribute to audits, including inspections, by the customer or its appointed auditor. Reviews shall normally begin with documentation, remote review and relevant independent audit reports where these are sufficient.

Audits shall be proportionate to the processing and risk, with reasonable notice, confidentiality and safeguards for other customers' data. On-site inspections shall be limited to relevant processing facilities and activities where necessary to verify compliance. Urgent incidents, credible non-compliance or authority requirements may justify shorter notice. Procedures and fees shall not make audit rights ineffective. Dyntora shall address identified deficiencies according to their risk.

Azure facilities are controlled by Microsoft, not Dyntora. Verification of those facilities shall normally use Microsoft's relevant independent audit reports and compliance information, which Dyntora shall make available or facilitate access to under appropriate confidentiality safeguards. This DPA does not grant direct entry to Microsoft datacentres. Where that evidence is insufficient, Dyntora shall pursue additional assurance or audit arrangements with Microsoft needed to meet applicable law. This does not exclude Dyntora's subprocessor responsibilities or restrict statutory audit rights or supervisory authorities' powers.

10. Return, deletion and duration

This DPA starts when validly accepted and applies for as long as Dyntora or its subprocessors retain personal data on the customer's behalf. At service end, at the customer's choice Dyntora shall return or delete all such personal data and delete existing copies, unless EU or Member State law requires storage. Export, active-data deletion and backup expiry follow Annex D. The customer may issue deletion instructions during the term through authorised controls or agreed contacts.

Backup copies shall remain protected and outside ordinary use until they expire under Annex D. Any recovery must respect existing deletion and restriction instructions before ordinary processing resumes. Legally required retention shall be limited to the required data and period, disclosed unless prohibited, and isolated from other uses. Dyntora shall confirm completed deletion on request, identifying any remaining backups or legally required retention.

11. Non-compliance and signatures

Dyntora shall promptly notify the customer if it cannot comply and cooperate to suspend affected processing. Material or persistent non-compliance permits termination of affected processing without ending deletion, confidentiality or statutory obligations. Commercial liability limits do not override mandatory rights, including GDPR Article 82.

For Customer: the authorised administrator and acceptance time recorded in the electronic acceptance receipt.

Dyntora offers this DPA as part of its published subscription terms. Customer acceptance of that offer incorporates this DPA without a separate handwritten signature.

Annex A — Processing description and customer instructions

Subject matter and duration: personal-data processing for the customer's Dyntora-hosted AZExecute subscription throughout the service term and Annex D's return/deletion period. Self-hosted services require separate agreement.

Purpose: customer-directed identity/access administration and infrastructure automation, including necessary operation, security and support.

Operations: collection, storage, retrieval, display, access checks, authorised automation, logging, support, export and deletion, according to enabled features and customer instructions.

Data subjects: the customer's users, administrators, employees, contractors and other persons identified in material necessary for authorised service use.

Data categories: names, work email addresses, user and organisation identifiers, roles, access rights and user-linked activity. Scripts, configurations, credentials, infrastructure information, outputs, technical requests and support material are included where they contain personal data. The customer shall minimise such data and not send passwords or private keys through ordinary support email.

Special-category and criminal-offence data are not authorised unless the parties first agree their purpose, lawful basis, scope and additional safeguards.

The customer controls its chosen integrations and destinations and is responsible for their contracts and lawful instructions. They are not Dyntora subprocessors solely because the customer connects them. Annex B identifies Dyntora's infrastructure provider.

Where the customer acts as processor, it shall provide the relevant controller's identity, authority and instructions. The customer remains the instruction contact unless otherwise agreed.

Annex B — Infrastructure provider, payment provider and locations

Microsoft Azure (Microsoft group) is the standard service's hosting and infrastructure subprocessor. Hosting and service backups are located in Denmark and Sweden.

Microsoft's applicable Products and Services Data Protection Addendum governs its processing. Dyntora shall identify its contracting Microsoft entity and relevant subprocessors, processing locations and safeguards for the customer's due diligence. Authorisation covers only the infrastructure used to provide the agreed service.

Microsoft support and onward processing may involve affiliates, subprocessors and access from outside the hosting countries. Such processing remains subject to clause 6; the hosting-country commitment does not imply that all provider access is confined to Denmark and Sweden.

Microsoft Azure is the only directly engaged infrastructure subprocessor currently identified for this service. Additions and replacements require the notice and objection procedure in clause 5.

Stripe provides payment services for Dyntora's billing relationship, separate from processing customer service data under this DPA. Dyntora is an independent controller for its billing and accounting purposes; Stripe's role depends on the payment activity. Stripe is not authorised here as an infrastructure subprocessor for customer service data.

Provider references: - Microsoft Products and Services DPA: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA - Microsoft EU Data Boundary and exceptions: https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn - Stripe DPA and processing roles: https://stripe.com/legal/dpa

These references supply provider information. Changes to a referenced website do not silently reduce Dyntora's obligations or replace the accepted version of this DPA.

Annex C — Technical and organisational obligations

Dyntora shall maintain the following security measures and evidence of their operation. These commitments do not constitute certification or a guarantee that incidents cannot occur. Implementation may change under clause 4 without reducing the agreed protection.

1. Identity and privileged access

Dyntora shall enforce authenticated access and permissions, restrict privileged access to authorised personnel and service identities, apply least privilege and multi-factor authentication for human privileged access, and review and remove access when responsibilities change. Support access requires a documented need and confidentiality obligations. The customer manages its user permissions and integration consents.

2. Customer data separation

Dyntora shall maintain controls preventing unauthorised access between customers' data, test their effectiveness when relevant changes are made and investigate suspected unauthorised access.

3. Data and secret protection

Dyntora shall encrypt personal data in transit and at rest, including backups. Credentials and keys shall be protected against unauthorised access or disclosure and replaced or revoked when compromised.

4. Infrastructure and change security

Dyntora shall restrict administrative access, maintain supported systems, assess and address vulnerabilities according to risk, and test security-relevant changes. Personal data shall not be exposed in public development or test environments.

5. Logging and data minimisation

Dyntora shall collect only logs needed for operation, security and troubleshooting, restrict access, avoid secrets and unnecessary customer content, and apply Annex D's retention limits.

6. Backup and recovery

Dyntora shall maintain protected backups in the locations specified in Annex B, test recovery and verify data integrity and access protections before resuming ordinary processing. Recovery must respect clause 10 and Annex D. This DPA does not promise a fixed recovery time or recovery point.

7. Incident response and personnel

Dyntora shall maintain incident response responsibilities and escalation, investigate and contain incidents, preserve relevant evidence and notify customers under clause 8. Personnel with access to personal data shall receive confidentiality and security instruction. Microsoft is responsible for physical security at its Azure facilities; Dyntora remains responsible for its own security measures and subprocessor oversight.

8. Evaluation and supplier oversight

Dyntora shall review security measures at least annually and after material changes or significant incidents, test their effectiveness according to risk, assess relevant provider assurances and track corrective actions to completion.

Annex D — Contacts, return and retention

Customer contact: the accepting administrator is the initial instruction and breach contact. The customer shall keep this current through info@azexecute.com. Dyntora shall verify authority before acting on instructions or disclosing data.

Dyntora contact: info@azexecute.com for privacy instructions, security reports and escalation. Reports should include a safe reply address and sufficient detail for investigation, without unnecessary personal data or secrets.

Return: the customer may use available export controls or request assistance from Dyntora to obtain its personal data in a usable format through secure delivery. Dyntora shall act in time for applicable legal deadlines. Acceptance of revised terms is not a condition of required data return.

Customer deletion: a deletion request through authorised service controls disables access immediately. Permanent deletion follows the recovery period shown in the service, normally seven days. Dyntora shall resolve failed deletion and assist with lawful instructions requiring a different timetable. Where return is requested, data shall not be destroyed before the agreed return is fulfilled.

Backup expiry: copies of deleted personal data shall expire no later than 90 calendar days after deletion from active systems. Until then, they remain protected and outside ordinary use. Any recovery is subject to clause 10. This retention limit does not guarantee that a particular recovery point remains available.

Logs: routine user-linked operational and security logs shall be deleted or anonymised when no longer needed and within six months. Evidence needed for an incident, rights request or legal obligation may be retained separately, restricted to that purpose and reviewed for deletion when no longer necessary.

Legal retention: Dyntora shall identify any EU or Member State retention requirement, affected data and period unless disclosure is prohibited, restrict use accordingly and delete the data when the requirement ends. Its independent-controller accounting records are governed separately.

Confirmation: on a verified request, Dyntora shall confirm completed deletion without undue delay and identify any remaining backups within their expiry period or legally required retention. A pending or failed deletion shall not be described as completed.

These annexes are part of the version identified in the electronic acceptance receipt. Customer identity and acceptance evidence belong to the individual organisation and are not published with this standard text.