Data Processing Agreement

GDPR Article 28 Compliance

Where Pentevo processes personal data on behalf of a customer who is established in the European Economic Area (EEA) or processes data of EEA residents, Pentevo acts as a Data Processor and the customer acts as the Data Controller.

Pentevo commits to the following obligations under GDPR Article 28:

• Process personal data only on documented instructions from the Controller.
• Ensure personnel authorized to process data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures (see below).
• Engage subprocessors only with prior written consent and under equivalent obligations.
• Assist the Controller with data subject rights requests within 30 days.
• Delete or return all personal data upon termination of the service.
• Provide all information necessary to demonstrate compliance with Article 28.
• Notify the Controller of any personal data breach without undue delay (within 72 hours of discovery).

Data Categories Processed

International Data Transfers

Pentevo's primary infrastructure is located in the United States (AWS us-east-1). Transfers of personal data from the EEA to the United States are governed by:

• Standard Contractual Clauses (SCCs) — EU Commission-approved SCCs are included in our DPA and apply to all EEA-to-US transfers.
• EU-US Data Privacy Framework — Pentevo is working toward certification. EEA customers operating under stricter requirements should execute the full DPA.

EU-resident data storage is available to enterprise customers on request at no additional cost. Contact legal@pentevo.com to request EU data residency.

Technical & Organizational Security Measures

The following measures are implemented to protect personal data as required by GDPR Article 32:

Subprocessors

Pentevo uses approved subprocessors to deliver the service. All subprocessors are bound by data processing agreements with equivalent obligations to this DPA. The full subprocessor list is published on our Trust Center.

Customers subscribed to our enterprise plan will receive 30 days advance written notice before any new subprocessor is engaged. You may object to a new subprocessor by contacting legal@pentevo.com.