2.1 For the purposes of the GDPR and other Applicable Laws, the Customer acts as the Data Controller and DIDWW acts as the Data Processor when processing Controller Personal Data through the Services.

DIDWW may also process limited Personal Data as an independent Data Controller for its own operational purposes (for example, account administration, billing, compliance, and fraud prevention) as described in the Privacy Policy.

These independent processing activities fall outside the scope of this DPA.

2.2 The Controller shall:

a) Determine the purposes and means of Processing of Controller Personal Data and warrants that such Processing has a valid lawful basis and complies with Applicable Law (including ePrivacy/PECR, TCPA/CTIA and equivalent local rules for consent/opt-out, sender ID/CLI, and marketing restrictions).

b) Provide documented, lawful instructions (including configuration choices within the Services) and acknowledges that the Processor may decline or request clarification of instructions that would breach Applicable Law or exceed the Services’ capabilities.

c) Ensure data accuracy, proportionality, and retention, supplies only data necessary for the Services, and does not upload Prohibited Data.

d) Implement Controller-side controls (e.g., audience selection, suppression lists, opt-out management, sender authentication) and be responsible for message/content legality and customer communications.

e) Respond to Data Subject Requests using available self-service features and will request Processor assistance only where necessary and bear associated reasonable costs as set out in the MSA/DPA.

f) Notify the Processor without undue delay of any suspected security incident, complaint, or regulatory inquiry that involves the Services and may affect Processor compliance.

g) Set or approve retention parameters within the Services consistent with Appendix 1 and its own policies.

h) Indemnify the Processor against any and all claims, fines, liabilities, and expenses arising from the Controller’s breach of this Section 2.2, including the submission of Prohibited Data or the lack of a lawful basis for Processing.

2.3 The Processor shall:

a) Process Controller Personal Data only on documented instructions from the Controller (including transfers), except where Processing is required by EU or Member State law; in such cases the Processor will inform the Controller unless prohibited.

b) Promptly inform the Controller if, in its opinion, an instruction infringes Applicable Law or the DPA.

c) Not determine purposes or means of Processing and may reject instructions that would violate law or the DPA.

d) Implement and maintain appropriate security measures as described in section 3 and Appendix 2.

e) Engage Sub-processors only under section 4 and remain fully liable for their performance.

f) Provide reasonable cooperation and make available information necessary for the Controller to verify the Processor’s compliance with this DPA, including through audit rights as set out in Section 5.

g) Notify without undue delay (target: within 48 hours) of any Personal Data Breach affecting Controller Personal Data and provide information reasonably required for the Controller’s notifications, per section 5.2.

h) Support audits under Section 5.3 by making available reasonable information and documentation demonstrating the Processor’s compliance with this DPA and applicable data-protection obligations, prior to any on-site inspection or as otherwise agreed between the Parties.

i) Manage international transfers under section 7, including general authorisation for interconnection/routing necessary to provide the Services, subject to appropriate safeguards.

j) Delete or return Controller Personal Data at the end of Services under section 8 and provide written confirmation upon request.

k) Maintain records of processing activities relevant to its role (Art. 30(2)), and cooperate with Supervisory Authorities on reasonable request.

2.4 For the avoidance of doubt, the Controller grants a general authorisation for Processing and transfer of Controller Personal Data as technically necessary to provide, deliver, interconnect, route, and operate the Services (including via DIDWWs, routing partners and network operators outside the EEA), subject to section 7 safeguards.

2.5 If any Controller instruction would breach this DPA, Applicable Law, or exceed the technical capabilities of the Services, the Processor shall promptly notify the Controller. The Processor may suspend only the affected processing until a lawful and feasible instruction is agreed. Such suspension shall not constitute a breach of this DPA.

3.1. Both Parties shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of Processing. Each Party is responsible for the security of the systems, credentials, and data under its control.

3.2. The Processor’s specific technical and organisational measures are described in Appendix 2 (Technical and Organisational Security Measures) and are designed to protect Controller Personal Data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures are periodically reviewed and updated to ensure ongoing effectiveness.

8.1. The Processor shall, to the extent feasible and based on information available, provide reasonable assistance to the Controller in fulfilling obligations under Articles 32–36 GDPR. Such assistance shall be limited to:

a) Data-subject requests that cannot be handled through the Service’s self-service tools;

b) Personal-data-breach notifications, as set out in § 5.2; and

c) Regulatory consultations, where required by law and directly related to the Services.

All other assistance, including participation in DPIAs or preparation of reports beyond standard documentation, shall be at the Controller’s cost and subject to mutual agreement.

8.2. The Processor shall notify the Controller without undue delay, and, where feasible, within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Controller Personal Data, and shall provide the Controller with sufficient information to meet any obligations to report or inform Data Subjects of the breach.

8.3. Audit rights:

a) The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

b) Audit hierarchy:

(i) Primary evidence shall be the Processor’s independent third-party audit reports or certifications (e.g., ISO/IEC 27001, SOC 2 Type II, or equivalent).

(ii) If further verification is justified, the Controller may conduct a remote review or written questionnaire.

(iii) On-site audits may occur no more than once per twelve (12) months, upon thirty (30) days’ prior written notice, during normal business hours, and at the Controller’s expense, unless Processor is confirmed to be in material breach of this DPA or an on-site audit is mandated by a Supervisory Authority.

c) Any auditor engaged by the Controller shall be independent, bound by confidentiality, and approved in advance by the Processor (not to be unreasonably withheld).

d) Findings and remediation: The Parties shall discuss findings in good faith and agree on reasonable remediation steps where applicable.

This Appendix details the security commitments and measures implemented by DIDWW Ireland Limited (the Processor) in accordance with Section 3 of the Data Processing Agreement (DPA).

DIDWW maintains security controls consistent with ISO/IEC 27001:2022 or equivalent recognised standards, ensuring confidentiality, integrity, availability, and resilience of the Services.

Key control domains include: access management, encryption, network security, data segregation, business continuity, incident management, and personnel awareness.

Detailed policies and control procedures are reviewed at least annually within the ISMS framework and are available to Customers under NDA upon reasonable request.

1. Access Control and Authentication

The Processor may update these technical and organisational measures from time to time to maintain or enhance their effectiveness; such updates shall not materially reduce the overall level of security.

6. Supplier and Change Management

The Processor maintains a formal supplier-risk-management and change-control process within its ISMS. Sub-processors are evaluated for security and data-protection compliance prior to onboarding and monitored thereafter. All significant system or infrastructure changes follow documented change-control procedures, including testing and approval.

A. United Kingdom (UK GDPR)

References to the GDPR include the UK GDPR and the Data Protection Act 2018.
The UK Addendum to the EU Standard Contractual Clauses applies to transfers of Personal Data from the United Kingdom.

B. Switzerland (FADP)

 References to the GDPR shall be interpreted consistently with theSwiss Federal Act on Data Protection (FADP).
References to the EU or Member States shall include Switzerland where contextually required.
The EU Standard Contractual Clauses, as adapted for Switzerland, apply to cross-border transfers.