Data Processing Addendum

1. Scope, status and precedence

This Data Processing Addendum (the "Addendum") forms part of the Terms of Service between Breneshold LLC, a limited liability company organized under the laws of the State of Florida, United States ("Witnio", the processor) and the customer identified in the Order ("Customer", the controller), and applies whenever Witnio processes personal data on the Customer's behalf.

It is drafted to meet article 28 of Regulation (EU) 2016/679 (GDPR) and, where the UK GDPR or the Swiss FADP applies, to be read together with the corresponding addenda.

In the event of conflict, this Addendum prevails over the Terms of Service and the Privacy Policy for processing carried out on the Customer's behalf. Where the Standard Contractual Clauses apply, they prevail over this Addendum.

It becomes binding when both parties execute it or it is expressly incorporated into an Order. The signature block, entity details and effective date are completed on the executed copy of this Addendum.

2. Definitions and roles

"Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR.

The Customer is the controller of the personal data contained in the Evidence and configuration it submits, and warrants that it has a lawful basis for that processing and has given every notice and obtained every consent required.

Witnio is the processor of that data and processes it only on the Customer's documented instructions.

Witnio is an independent controller for account, billing, support and website data, and for the security and audit records it is required to keep. The Privacy Policy governs that processing, not this Addendum.

3. Subject matter, duration, nature and purpose

Subject matter: provision of the real-device observation and evidence services ordered by the Customer.

Duration: the term of the Terms of Service, plus the export and deletion periods set out below.

Nature and purpose: executing checks on physical devices; recording what was observed; masking and minimising what is captured; generating, hashing and signing Evidence; storing and serving Evidence to the Customer; alerting; and providing support.

Processing operations: collection, recording, organisation, structuring, storage, retrieval, consultation, use, restriction, erasure and destruction.

4. Categories of data subjects and personal data

Categories of data subjects: the Customer's personnel and authorised users; the individuals whose identifiers appear in the traffic the Customer directs at a Witnio number; and any individual visible in a screenshot or recording of a target the Customer configures.

Categories of personal data: telephone numbers and sender identifiers, stored masked; message content, stored masked and truncated with a hash of the original; timestamps and latency; device, operating system, dialer, SIM, carrier and corridor context; web request results, redirect chains, cookies and consent state observed on a target; screenshots and, for some products, video of the device screen; and the signed manifest binding these together.

Special categories of personal data: none are requested, and the Customer must not configure a check that causes them to be processed. If special category data is nevertheless captured, the Customer must tell Witnio without delay so that it can be deleted.

Frequency: continuous, for as long as the Customer's checks are active.

5. Customer instructions

Witnio processes personal data only on the Customer's documented instructions, which consist of this Addendum, the Terms of Service, the Order, and the configuration the Customer sets in the service — unless a law to which Witnio is subject requires otherwise, in which case Witnio will inform the Customer before processing unless that law forbids it.

Witnio will inform the Customer if, in its opinion, an instruction infringes the GDPR or another data protection provision, and may suspend the affected processing until the instruction is corrected.

The Customer instructs Witnio to apply the masking and minimisation described in the Privacy Policy to everything captured, and acknowledges that this reduces the personal data actually stored.

The Customer will not submit personal data beyond what the check requires, and will use test traffic rather than the real communications of end users.

6. Confidentiality of personnel

Witnio ensures that every person authorised to process personal data under this Addendum is bound by a duty of confidentiality that survives the end of their engagement, is trained on their obligations, and has access only to the data they need.

Access to production data is limited to named personnel, authenticated with multi-factor authentication, and logged.

7. Security measures

Witnio implements the technical and organisational measures set out in Annex II below, taking account of the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing, as well as the risk to data subjects.

Witnio may change a measure provided the change does not reduce the overall level of security. The measures in force at any time are published on the Security page of this website, which forms part of Annex II.

8. Sub-processors

The Customer gives Witnio a general written authorisation to engage sub-processors. Those engaged at the date of this Addendum are listed in the Privacy Policy, together with their role.

Witnio imposes on every sub-processor, by written contract, data protection obligations no less protective than those in this Addendum, and remains fully liable to the Customer for the sub-processor's performance.

Witnio will give the Customer at least 30 days' notice before adding or replacing a sub-processor, by email to the account contact and by updating the published list. The Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it cannot be resolved the Customer may terminate the affected subscription and receive a refund of the unused prepaid fees for it.

The sub-processors named in this document (Stripe, PayPal, Cloudflare, Witnio's own infrastructure and Telegram for internal alerts only); customers receive change notices by writing to [email protected]

9. Assistance with data subject rights

Witnio will, by appropriate technical and organisational measures and insofar as it is possible, assist the Customer in fulfilling its obligation to respond to requests to exercise a data subject's rights.

Where a data subject contacts Witnio directly about data processed on the Customer's behalf, Witnio will not respond substantively and will refer the request to the Customer without undue delay.

The service provides the Customer with export and deletion functions, which are the primary means of satisfying access, portability and erasure requests. Assistance beyond that is charged at Witnio's reasonable rates where the effort is more than trivial.

10. Assistance with security, impact assessments and breaches

Witnio will assist the Customer in complying with articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to it, including by providing the information needed for a data protection impact assessment and for a prior consultation.

Witnio will notify the Customer of a personal data breach affecting the Customer's personal data without undue delay and in any event within 72 hours of becoming aware of it, describing the nature of the breach, the categories and approximate number of data subjects and records affected as far as known, the likely consequences, the measures taken or proposed, and a contact point for more information. Further information follows as the investigation proceeds.

Witnio will not notify a supervisory authority or a data subject on the Customer's behalf unless the Customer instructs it to and the parties agree the wording.

11. Deletion and return

On termination of the service, Witnio will, at the Customer's choice, return the personal data processed on its behalf or delete it.

Customer Data remains available for export through the service for 30 days after termination. After that period Witnio deletes or irreversibly anonymises it, except to the extent a law to which Witnio is subject requires storage, in which case Witnio keeps it confidential and processes it only for that purpose.

Copies present only in backups are deleted when those backups are overwritten on their normal cycle. Witnio will confirm deletion in writing on request.

12. Audits and information

Witnio will make available to the Customer the information necessary to demonstrate compliance with article 28 of the GDPR.

The Customer may satisfy its audit right by reviewing the documentation Witnio publishes and provides — including the Security page, the evidence-signing scheme, and Witnio's written answers to a security questionnaire, which Witnio will return within 30 days of a reasonable request.

Where that is not sufficient to meet a demonstrated regulatory requirement, the Customer may conduct, or appoint an independent auditor bound by confidentiality to conduct, an on-site audit once in any twelve-month period, on at least 30 days' written notice, during business hours, without unreasonable disruption, and at the Customer's cost, including Witnio's reasonable time. A supervisory authority may audit as the law provides.

An auditor may not be a competitor of Witnio, and may not access another customer's data, Witnio's source code, or any credential.

13. International transfers

Witnio processes personal data on infrastructure it operates in Costa Rica and uses sub-processors established in the United States and elsewhere.

For transfers of personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties incorporate by reference the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, with Module Two (controller to processor) applying between the Customer as data exporter and Witnio as data importer, the docking clause applying, the supervisory authority and governing law being those of the Customer's place of establishment, and Annex I and Annex II of this Addendum populating the corresponding annexes of those Clauses.

For the United Kingdom, the UK International Data Transfer Addendum to those Clauses applies. For Switzerland, references to the GDPR are read as references to the FADP, and the Federal Data Protection and Information Commissioner is the competent authority.

Witnio will notify the Customer if it becomes unable to comply with those Clauses, and the Customer may then suspend the transfer or terminate.

Breneshold LLC as data importer under Module 2 (controller to processor) of the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, with the optional docking clause not selected; a transfer impact assessment is documented before the first EU transfer.

14. Liability

Each party's liability under this Addendum is subject to the exclusions and to the aggregate cap in the Terms of Service, and that cap is a single combined cap across the Terms of Service and this Addendum, not a separate one.

Nothing in this Addendum limits a data subject's rights against either party, or a party's liability where the applicable law does not permit it to be limited. Where the Standard Contractual Clauses apply, nothing in this section limits liability under them towards a data subject.

15. Annex I — details of the processing

Data exporter: the Customer identified in the Order, acting as controller. Contact: the account contact registered in the service.

Data importer: Breneshold LLC (Florida, United States), [email protected]; the postal address is stated in the account and on invoices, acting as processor, providing real-device observation and evidence services.

Categories of data subjects, categories of personal data, special categories, frequency, nature and purpose, duration, and sub-processor details: as stated in sections 3, 4, 8 and 11 of this Addendum.

Competent supervisory authority: the authority of the Customer's place of establishment in the European Economic Area or, where the Customer is not established there, the authority of the Member State in which its representative is established or in which the data subjects are located.

16. Annex II — technical and organisational measures

Access control: multi-factor authentication; role-based access control; deny-by-default authorisation; tenant scoping on every tenant-owned query; short-lived tokens with refresh rotation; revocable sessions; session and device inventory; brute-force protection; and scoped, rotatable API keys with quotas and rate limits.

Network and platform: every public interface treated as hostile; an edge gateway and rate limiting in front of the control plane; the device farm never exposed directly to the internet; and security response headers on every page.

Data minimisation and masking: one-time passcodes, third-party numbers, sensitive content, tokens, cookies and unnecessary identifiers masked or minimised before storage and before any AI processing; message bodies stored masked and truncated, with a hash of the original.

Integrity: a SHA-256 hash for each artifact; canonical JSON manifests signed with an Ed25519 key held outside the repository on the signing host; a published public key so a manifest can be verified independently; and tamper detection on verification.

Confidentiality of secrets: no credential, one-time passcode, cookie or session token in the repository, in logs or in traces; secrets held in a secrets manager.

Testing and assurance: dependency, secret, container and insecure-default scanning on every release; authentication-abuse and cross-tenant regression tests; and validation of the cross-origin configuration.

Availability and resilience: targeted suspension controls that isolate an abusive key, user or tenant without taking down the platform; Evidence preserved through a suspension; and documented recovery procedures for device, network and evidence-upload failures.

Governance: audit logging of privileged actions; a documented incident procedure of detect, contain, revoke, preserve evidence, root-cause analysis, fix, regression test, retest and document; and retention limits enforced by an automated retention process.

The measures in force at any moment are published on the Witnio Security page, which forms part of this Annex.

17. Contact

Data protection questions and notices under this Addendum: [email protected].

Data protection officer or EU/UK representative, where one is appointed: Breneshold LLC, [email protected].