Andmetöötlusleping

⚠ DRAFT v0.2 — NOT IN FORCE, REVIEW REQUIRED. Revised draft of 2026-10-08: checked against GDPR Article 28, the Commission standard contractual clauses for controllers and processors (Implementing Decision (EU) 2021/915), the EU Data Act and the product specification. It is not yet approved by Paysera and binds no one. Items in square brackets [●] are still open. Do not rely on this text before a version without the "draft" mark is published.

PAYSERA Q-GO DATA PROCESSING AGREEMENT

This English version is a translation; in case of discrepancy the Lithuanian version prevails.

Annex No. 1 to the Paysera Q-GO Terms of Service

PREAMBLE

This Data Processing Agreement (hereinafter – the DPA) forms an integral part of the Paysera Q-GO Terms of Service (hereinafter – the Terms) and is concluded pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter – the GDPR). The DPA sets out the conditions under which Paysera LT, UAB, as processor, processes personal data on behalf of the Client, as controller, in providing the queue and visit management service "Paysera Q-GO".

The DPA applies to business relationships only: the Client is always a legal person or another business entity acting for the purposes of its economic, commercial or professional activity. The Service is not provided to consumers (natural persons acting for purposes unrelated to business).

1. DEFINITIONS

1.1. Capitalised terms used in this DPA have the meanings set out below. Other terms (personal data, processing, controller, processor, data subject, personal data breach, supervisory authority, third country, etc.) are used with the meanings defined in Article 4 GDPR.

1.2. Paysera or Processor – Paysera LT, UAB, legal entity code 300060819, registered office Pilaitės pr. 16, LT-04352 Vilnius, Lithuania, an electronic money institution supervised by the Bank of Lithuania (licence No. 1, Bank of Lithuania register No. LB000251).

1.3. Client or Controller – a legal person or another business entity which, upon registering for the Service, has entered into the Terms and this DPA and on whose behalf a separate organisation space (on the platform – a "tenant") has been created in the Service.

1.4. Service – the "Paysera Q-GO" queue and visit management software as a service (SaaS), comprising the customer ticket page, the self-service kiosk, the display (TV) view, the operator console and the management console, as defined in the Terms.

1.5. Console – the management console of the Service, accessible to the Client's Administrators.

1.6. Client Data – all personal data which the Client, its Users or Visitors submit to the Service or which is created in the Service on behalf of the Client, and which Paysera processes on behalf of the Client under this DPA.

1.7. Visitor – a natural person who approaches the Client or its service point and whose ticket, visit or request is registered in the Service (the Client's customer, patient, applicant, etc.).

1.8. User – an employee of the Client or another natural person authorised by the Client who has access to the Service on behalf of the Client: an Administrator (has access to the Console and the right to accept documents on behalf of the organisation) or an Operator (serves queues in the operator console).

1.9. Sub-processor – another processor within the meaning of Article 28(2) and (4) GDPR engaged by Paysera to process Client Data.

1.10. Instructions – the Client's documented instructions regarding the processing of Client Data, as defined in Section 5 of the DPA.

1.11. Individual Agreement – a separate agreement signed by both Parties on the provision of the Service and/or the processing of personal data.

1.12. Data Act – Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data.

1.13. ADTAĮ – the Law on Legal Protection of Personal Data of the Republic of Lithuania (ADTAĮ).

1.14. Supervisory Authority – the State Data Protection Inspectorate (VDAI) or another authority competent under Articles 55–56 GDPR.

1.15. Breach – a personal data breach within the meaning of Article 4(12) GDPR relating to Client Data.

Legal basis: GDPR Article 4(1), (2), (7), (8), (9), (10), (12); GDPR Article 28(2) and (4); ADTAĮ Article 2(3); Data Act Article 2.

2. PARTIES, ROLES AND CONCLUSION OF THE DPA

2.1. Roles

2.1.1. The Client is the controller in respect of Client Data: it determines the purposes and means of processing the personal data of Visitors and Users, chooses which data to collect (e.g., whether to request the Visitor's telephone number), which services and service points to configure, and which Users to authorise.

2.1.2. Paysera is the processor: it processes Client Data only on behalf of the Client and only in accordance with the Instructions, in providing the Service.

2.1.3. The Parties are not joint controllers within the meaning of Article 26 GDPR. Paysera does not independently determine the purposes and means of processing Client Data; if Paysera were to do so in breach of this DPA, it would be considered a controller in respect of such processing (Article 28(10) GDPR).

2.2. Data in respect of which Paysera is an independent controller

2.2.1. This DPA does not apply to personal data which Paysera processes for purposes determined by itself as an independent controller, namely:

a) identity and contact data of the Client's representatives, Administrators and contact persons, processed for the purposes of concluding and performing the Terms, invoicing, sending notices and retaining evidence of acceptance of document versions;

b) payment data processed by Paysera as payment service provider via "Paysera Checkout" (including the payment card data token stored for automatic recurring payments);

c) perimeter security logs of Paysera's own infrastructure (load balancer and attack protection records) used to protect Paysera's systems against fraud and attacks, and data necessary to perform Paysera's own legal obligations (accounting, tax). Sign-in and activity records inside the Client's account, including the audit log, are Client Data processed under this DPA. Error and diagnostic records that contain Client Data (including bug reports submitted by Users) are processed by Paysera as processor under this DPA, solely to provide and secure the Service, and are retained for no longer than necessary for that purpose [● retention period to be confirmed: error monitoring and the bug-report tracker].

2.2.2. Such processing is governed by the Paysera privacy policy published at [● – a privacy policy covering the Service has not yet been prepared] and by applicable law.

2.3. Conclusion of the DPA by electronic means

2.3.1. The DPA is concluded at the time of the Client's registration for the Service: the natural person representing the Client ticks acceptance of the Terms and this DPA on behalf of the Client (organisation) and confirms that they hold sufficient authority to do so. The Parties agree that such ticking is equivalent to written form and satisfies the requirement of Article 28(9) GDPR that the contract be in writing, including in electronic form.

2.3.2. The person who confirmed the authority is liable to the Client and to Paysera for its genuineness in the manner prescribed by Articles 2.132–2.133 of the Civil Code of the Republic of Lithuania (CK). The Client may not rely on a defect of authority if it has actually used the Service.

2.3.3. For each acceptance Paysera records the Client, the accepting person, the document type and version, the language shown, the date and time and the IP address. Paysera confirms registration by e-mail; the order confirmation sent after each paid order states the accepted versions of the Terms and the DPA and attaches them in PDF format.

2.4. Versioning

2.4.1. The DPA is versioned. From the effective date of a new version of the DPA (clauses 16.3 and 16.5 of the Terms), the Client's Administrator must accept it in the Console. Until the new version is accepted, the Console is unavailable to the Administrator; the work of Operators, the servicing of Visitors, the kiosk and the displays operate without interruption.

2.4.2. Until the new version is accepted, the processing of Client Data is governed by the last version of the DPA accepted by the Client. A Client that does not agree with the new version may cancel the subscription in the manner set out in the Terms.

2.4.3. All versions of the DPA are retained, published at permanent addresses and downloadable in PDF format. Records of the versions accepted by the Client and the time of acceptance are kept in Paysera's audit log as evidence under Article 28(9) GDPR.

2.5. Precedence of an Individual Agreement

2.5.1. If an Individual Agreement has been signed between the Parties, this DPA applies to it unless the Individual Agreement contains its own data processing terms meeting Article 28(3) GDPR, in which case those terms prevail (clause 17.4 of the Terms).

2.6. Hierarchy of documents

2.6.1. In matters concerning the processing of Client Data, the DPA takes precedence over the Terms. Annexes No. 1–3 form an integral part of the DPA. Provisions that directly transpose mandatory requirements of the GDPR may not be interpreted so as to narrow them.

2.7. Obligations and rights of the Controller

2.7.1. The Client, as Controller, must:

a) ensure the lawfulness of the processing of Client Data, including an appropriate legal basis (Article 6 GDPR and, in the case of special categories of data, also Article 9(2) GDPR);

b) provide Visitors and Users with the information required under Articles 13–14 GDPR (e.g., a privacy notice at the kiosk, on the ticket page, at the service point); Paysera does not undertake to provide this information on the Client's behalf;

c) configure the Service in accordance with the principle of data minimisation (Article 5(1)(c) GDPR), including the selection of the Visitor data fields collected;

d) administer User accounts, access rights and their revocation, and ensure the security of Users' login credentials;

e) give only lawful Instructions;

f) respond to data subjects' requests and communicate with the Supervisory Authority on its own;

g) carry out a data protection impact assessment where mandatory (Article 35 GDPR).

2.7.2. The Client has the right to give Instructions, to verify Paysera's compliance in the manner set out in Section 13 of the DPA, to object to new Sub-processors (Section 8) and to receive the assistance provided for in the DPA.

Legal basis: GDPR Article 4(7)–(8), Article 24, Article 26, Article 28(1), (3), (9) and (10), Article 5(1)–(2), Article 6, Articles 13–14, Article 35; Articles 11–12 of the Law on Information Society Services of the Republic of Lithuania (IVPĮ); CK Article 1.71, Article 1.73(2), Articles 2.132–2.133, Article 6.156, Articles 6.185–6.186; Commission Implementing Decision (EU) 2021/915 (Article 28(7) GDPR) – as a reference standard.

3. SUBJECT-MATTER, DURATION, NATURE AND PURPOSE OF PROCESSING

3.1. Subject-matter. The processing of Client Data necessary for the provision of the Service: registration of Visitors' tickets and visits, queue management, calling to a service point, sending notifications to Visitors via channels chosen by the Client, authentication of Users and logging of their actions, and generation of service statistics.

3.2. Duration. Processing takes place from the conclusion of the DPA until the expiry of the Terms and thereafter – during the data retrieval period and the archive retention period of 12 (twelve) months from archiving of the Client's account (clause 9.5.2 of the Terms), until the complete deletion or return of Client Data under Section 12 of the DPA. The duration includes the free 14 (fourteen)-day trial period, the 7 (seven)-day grace period following it, the 14 (fourteen)-day payment grace period following a failed charge and the Service suspension period, as defined in the Terms.

3.3. Nature. Automated processing: collection, recording, organisation, structuring, storage, adaptation, consultation, use, disclosure by transmission (notifications to Visitors by e-mail or another channel offered by the Platform), alignment, restriction, erasure and anonymisation. Paysera does not take automated decisions within the meaning of Article 22 GDPR; the queue order is determined according to the rules configured by the Client.

3.4. Purpose. The sole purpose is the provision of the Service to the Client under the Terms and the Instructions. Paysera does not process Client Data for its own purposes and does not use it for profiling, marketing, product training or for the benefit of other clients. Anonymised, aggregated statistical data is not personal data (Recital 26 GDPR) and its use is governed by the Terms.

3.5. A detailed description of the processing is set out in Annex No. 1.

Legal basis: GDPR Article 28(3), first subparagraph; Article 4(2); Article 5(1)(b); Article 22; Recital 26.

4. CATEGORIES OF DATA SUBJECTS AND OF PERSONAL DATA

4.1. Categories of data subjects:

a) Visitors – the Client's customers, patients, applicants and other natural persons whose tickets or visits are registered in the Service;

b) Users – the Client's employees and other authorised persons (Administrators, Operators).

4.2. Categories of personal data:

a) identity data: name or initials (in the case of Visitors – at the Client's election), Users' first name and surname;

b) contact data: e-mail address, telephone number (if the Client has enabled the notification channel);

c) ticket and visit data: ticket number, service selection, service point, timestamps (registration, call, start and end of service), status, booking data, visit history;

d) feedback: customer satisfaction (CSAT) scores and free-text comments, if the Client has enabled this function;

e) sign-in data: Users' e-mail addresses, password hashes and roles and, where the Client has connected its own identity provider (SSO) or a User signs in with a Google account, the identifiers and e-mail address received from that provider;

f) technical data: IP addresses, browser and device identifiers, session tokens;

g) audit log entries: Users' actions in the Service with timestamps and identifiers;

h) customer profile data, if the Client uses the identified customer list function: notes, visit history summaries, visit reasons, tags and preferences linked to an identified Visitor.

4.3. Special categories of data. The Service is not intended for the processing of data referred to in Article 9(1) or Article 10 GDPR and Paysera does not process such data, but such data may be revealed indirectly due to the nature of the Client's activity (e.g., the service names of a healthcare institution). In that case the Client must inform Paysera in writing before commencing processing, ensure a basis under Article 9(2) GDPR and is responsible for the content entered by Visitors or Users in free-text fields (e.g., comments).

4.4. The Client is responsible for ensuring that only such data is entered into the Service as is necessary for the Client's purposes and for which the measures provided for in the DPA are appropriate.

Legal basis: GDPR Article 28(3), first subparagraph; Article 4(1); Article 5(1)(c); Article 9(1)–(2); Article 10.

5. PROCESSING ONLY ON DOCUMENTED INSTRUCTIONS

5.1. Paysera processes Client Data only on the Client's documented Instructions, including with regard to transfers of Client Data to a third country or an international organisation, unless required to do so by Union or Republic of Lithuania law to which Paysera is subject. In such a case, Paysera shall inform the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.2. The following are deemed Instructions (in order of precedence):

a) this DPA and its Annexes;

b) the Terms, to the extent they describe the operation of the Service;

c) the configuration of the Service in the Console performed by the Client's Administrators (selection of services, service points, fields collected, notification channels, retention settings) and the actions of Users using the functions of the Service;

d) additional written Instructions sent by an Administrator from the e-mail address registered for that Administrator in the Console to qms@paysera.com.

5.3. Only the Client's Administrators are entitled to give Instructions. Paysera is entitled to reasonably assume that a person acting through an Administrator account has been duly authorised by the Client.

5.4. Additional Instructions exceeding the standard scope of the Service's functions are carried out if they are technically feasible and the Parties agree in advance in writing on the implementation deadline and remuneration. Paysera is not obliged to change the architecture of the Service on the basis of individual Instructions.

5.5. Paysera ensures that persons authorised by it process Client Data only in accordance with the Instructions (Article 29, Article 32(4) GDPR).

5.6. If Paysera considers that an Instruction infringes the GDPR or other data protection provisions, Section 16 of the DPA applies.

Legal basis: GDPR Article 28(3)(a); Article 29; Article 32(4); CK Article 6.200.

6. CONFIDENTIALITY

6.1. Paysera ensures that persons authorised to process Client Data (employees, contractors) have committed themselves in writing to confidentiality or are under a statutory obligation of confidentiality, and that access is granted only on a "need-to-know" basis.

6.2. The confidentiality undertaking covers all Client Data, the Client's configuration, service statistics and other information obtained from the use of the Service. The undertaking applies indefinitely, including after the expiry of the DPA and of the employment or contractual relationship with the authorised person.

6.3. The Client ensures that information on Paysera's security measures, audit results and Breach investigations obtained under the DPA is used solely for the purpose of assessing compliance with the GDPR and is not disclosed to third parties, other than the Supervisory Authority, the Client's auditors and professional advisers bound by confidentiality.

6.4. A Party that is required by law or by a binding demand of a competent authority to disclose confidential information shall, to the extent permitted, inform the other Party before disclosure and disclose only the extent required.

Legal basis: GDPR Article 28(3)(b); Article 29; Article 32(4); CK Article 1.116; Law on the Legal Protection of Trade Secrets of the Republic of Lithuania.

7. SECURITY MEASURES (ARTICLE 32 GDPR)

7.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risks to the rights and freedoms of natural persons, Paysera implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The measures are described in detail in Annex No. 2 and include at least:

a) tenant isolation at the database row level (row-level security): every record is assigned to the Client's tenant, and queries are executed only within a mandatory tenant context;

b) encryption in transit (HTTPS/TLS) and at rest (AES-256 encryption applied by the infrastructure provider, including backups; credentials for third-party systems supplied by the Client are additionally encrypted with a key held in a key management service);

c) access control: role-based access (Administrator / Operator), integration with the Client's identity provider, Paysera staff access on the least-privilege principle with logging;

d) an immutable (append-only) audit log recording the actions of Users and Paysera staff on Client Data;

e) daily automated backups with point-in-time recovery, kept for 7 days, and recovery procedures (Annex No. 2);

f) regular testing, assessing and evaluating of the effectiveness of the measures.

7.2. Paysera may change and improve the measures set out in Annex No. 2, provided that the overall level of security is not reduced. A material change to a measure that reduces the level of security is deemed a change of DPA version and is accepted in the manner set out in clause 2.4.

7.3. The Client independently assesses whether the measures set out in Annex No. 2 are appropriate to the risk presented by the Client Data it processes, and is responsible for security on its own side: the security of Users' login credentials, kiosk and display devices, its own identity provider and network, the review of access rights and the deactivation of accounts of Users who have left the Client.

7.4. The Parties acknowledge that the occurrence of a Breach does not in itself mean that the measures implemented were inappropriate; appropriateness is assessed against the criteria of Article 32 GDPR (judgment of the CJEU of 14 December 2023 in Case C‑340/21).

Legal basis: GDPR Article 28(3)(c); Article 32(1)–(4); Article 5(1)(f); Article 24; Article 25; CJEU Case C‑340/21.

8. SUB-PROCESSORS

8.1. General authorisation. The Client grants Paysera a general written authorisation to engage Sub-processors. The Sub-processors engaged at the time of conclusion of the DPA are listed in Annex No. 3: Google Cloud EMEA Limited (cloud infrastructure, region europe-west1, Belgium) and the operator of the Paysera SMTP relay used for e-mail delivery, where it is not Paysera LT, UAB [● confirm]. Sub-processors are added or replaced only in accordance with clauses 8.2–8.4.

8.2. Notice and right to object. Paysera informs the Client of any intended engagement of a new Sub-processor or replacement of an existing one by e-mail to the Administrators and by a notification in the Console no later than 30 (thirty) calendar days before the change, stating the Sub-processor's name, location, the nature of processing and the safeguards applied. Within this period the Client may raise a reasoned objection in writing on data protection grounds.

8.3. Upon receipt of an objection, Paysera shall, within 15 (fifteen) business days, propose a reasonable solution (e.g., an alternative Sub-processor, additional safeguards or disabling for the Client the function for which the Sub-processor is required). If no agreement is reached, the Client has the right to terminate the Agreement with effect from the date the new Sub-processor would begin processing Client Data; clause 8.2.1 of the Terms applies to fees already paid. Until the cancellation takes effect, Paysera shall, to the extent technically feasible, not apply the disputed Sub-processor to Client Data.

8.4. Urgent replacement. If the replacement of a Sub-processor is urgently necessary due to a security incident or the discontinuation of the Sub-processor's service, Paysera informs the Client immediately, and the objection period referred to in clause 8.2 runs from the date of the notice.

8.5. Flow-down of terms. Paysera enters into a written contract with each Sub-processor imposing on the Sub-processor substantially the same data protection obligations as are set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor fails to fulfil its obligations, Paysera remains fully liable to the Client for the performance of the Sub-processor's obligations.

8.6. Not Sub-processors. The following are not considered Sub-processors: (a) the identity provider chosen by the Client – it is the Client's processor or an independent controller; (b) Paysera as payment service provider via "Paysera Checkout" (see clause 2.2); (c) third-party integrations connected independently by the Client; (d) telecommunications operators that merely transmit notifications over their networks; (e) Google as the provider of "Sign in with Google" chosen by a User – it acts as an independent controller.

8.7. At the Client's request, Paysera provides the data protection terms of a Sub-processor contract (commercial terms may be redacted; for standard published terms a link suffices). Paysera notifies the Client of any failure by a Sub-processor to fulfil its data protection obligations that affects Client Data. To the extent the Sub-processor's terms permit, Paysera ensures that, if Paysera has factually disappeared, ceased to exist in law or become insolvent, the Client may instruct the Sub-processor to return or erase Client Data.

Legal basis: GDPR Article 28(2) and (4); Article 28(3)(d); Article 28(1).

9. ASSISTANCE TO THE CONTROLLER IN FULFILLING DATA SUBJECTS' RIGHTS

9.1. Taking into account the nature of the processing, Paysera assists the Client by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Client's obligation to respond to requests by data subjects for exercising their rights laid down in Chapter III GDPR.

9.2. Self-service tools. The following functions are available to the Client in the Console: search for a Visitor's data, export of a Visitor's data in a machine-readable format (JSON), erasure of a Visitor's personal data (by irreversible anonymisation), deactivation of a User account and export of the Client's data (clause 12.2). The Client uses these tools independently, without Paysera's involvement; each export and erasure is recorded in the audit log.

9.3. Additional assistance. Where a request cannot be fulfilled using the self-service tools, Paysera, upon receipt of a written request from an Administrator, provides assistance no later than within 10 (ten) business days so that the Client can comply with the one-month time limit under Article 12(3) GDPR. A fee agreed in advance may be charged only for assistance that is manifestly disproportionate or repetitive and exceeds the scope of the Service.

9.4. Requests received directly. If a data subject contacts Paysera directly regarding Client Data, Paysera does not respond to the request on the merits but forwards it to the Client no later than within 3 (three) business days and, where the data subject's communication so permits, informs the data subject that the request has been forwarded to the Controller.

9.5. If Paysera becomes aware that Client Data is inaccurate or outdated, it informs the Client without undue delay.

Legal basis: GDPR Article 28(3)(e); Article 12(3); Articles 15–22.

10. ASSISTANCE WITH OBLIGATIONS UNDER ARTICLES 32–36 GDPR AND BREACH NOTIFICATION

10.1. Assistance

10.1.1. Taking into account the nature of the processing and the information available to it, Paysera assists the Client in fulfilling the obligations laid down in Articles 32–36 GDPR: it provides the information on security measures set out in Annex No. 2, a description of data flows and other reasonably requested information required for the Client's data protection impact assessment (Article 35 GDPR) or prior consultation with the Supervisory Authority (Article 36 GDPR).

10.2. Breach notification

10.2.1. Upon becoming aware of a Breach, Paysera shall notify the Client without undue delay, and no later than within 24 (twenty-four) hours of becoming aware, by e-mail to all of the Client's Administrators. Paysera is deemed to have become aware of a Breach when it has a reasonable degree of certainty that a security incident has compromised Client Data; Paysera investigates suspected incidents promptly and does not delay the notification in order to complete the investigation. The initial notification contains the information then available and is supplemented under clause 10.2.3.

10.2.2. The notification contains the information referred to in Article 33(3) GDPR, to the extent known to Paysera:

a) the nature of the Breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

b) the name and contact details of Paysera's data protection officer or other contact person;

c) the likely consequences of the Breach;

d) the measures taken or proposed to be taken by Paysera to address the Breach and to mitigate its possible adverse effects.

10.2.3. Where it is not possible to provide all the information at the same time, it is provided in phases without undue further delay. Paysera documents the Breach, its facts, its effects and the remedial action taken, and provides this documentation to the Client upon request.

10.2.4. The obligation to notify the Supervisory Authority (Article 33(1) GDPR) and data subjects (Article 34 GDPR), and the decision as to whether such notification is necessary, rest with the Client. Paysera notifies the Supervisory Authority or data subjects regarding Client Data only on the Client's Instruction or where directly required by law.

10.2.5. In the event of a Breach occurring at a Sub-processor, the same time limits apply, running from the moment Paysera became aware of it.

10.2.6. A Breach notification does not constitute an admission of liability or fault by Paysera.

10.2.7. Paysera informs the Client of security incidents that did not result in a breach of Client Data but are significant to the security of the Service by e-mail to the Administrators within a reasonable time after the incident has been contained.

Legal basis: GDPR Article 28(3)(f); Article 32; Article 33(1)–(5); Article 34; Articles 35–36; Article 4(12).

11. RETENTION PERIODS

11.1. Operational Visitor data (name or initials, contact details, ticket and visit data, feedback, IP addresses) is retained for 90 (ninety) days from the completion of the ticket or visit (counted from the moment the ticket reaches its final status) and is thereafter automatically and irreversibly anonymised. This period is deemed the Client's standard Instruction. At the Client's request, Paysera may set a different period for the Client of between 30 and 365 days.

11.2. Anonymised statistical data (service times, flows, CSAT averages by service and location without any link to a specific person) is not personal data and may be retained for the Client's statistics indefinitely; this DPA does not apply to it.

11.3. Customer profile data (where the Client uses the identified customer list function: notes, visit history summaries, preferences) is not anonymised automatically: it is retained until the Client deletes it in the Console or erases it on a data subject's request (clause 9.2), but no longer than until the deletion under Section 12 of the DPA. The Client, as Controller, determines the retention period of such data and ensures compliance with the storage limitation principle.

11.4. User data is retained for as long as the User account exists in the Client's account; the data of a deactivated account is retained as part of the history of actions in the Client's account until the deletion under Section 12 of the DPA, unless the Client requests earlier deletion.

11.5. Audit log entries are retained for the lifetime of the Client's account for security and accountability purposes (Article 5(2), Article 32 GDPR) and are deleted in the manner set out in Section 12 of the DPA. Where a Visitor's data is erased under clause 9.2, the related audit entries remain, but their personal data is no longer displayed or exported.

11.6. Backups are rotated and deleted within 7 (seven) days; deleted or anonymised data is not restored from backups into the live system, except in the event of an emergency full-system restore, after which the deletion or anonymisation is repeated immediately.

11.7. Suspended Service. Upon suspension of the Service (where no subscription is taken out after the trial period, in the event of non-payment or upon cancellation of the subscription), Client Data is retained for not less than 30 (thirty) calendar days so that the Client can resume the Service or retrieve the data; upon expiry of this period the Client's account is archived. Client Data is then kept in the archive during the archive retention period of 12 (twelve) months from archiving (clause 9.5.2 of the Terms), after which Section 12 of the DPA applies; during that period operational Visitor data continues to be anonymised under clause 11.1.

Legal basis: GDPR Article 5(1)(c) and (e), Article 5(2); Article 28(3)(a) and (g); Recital 26.

12. END OF THE AGREEMENT: RETURN AND DELETION OF DATA

12.1. Grounds for termination. The DPA terminates together with the Terms: upon expiry of the paid period following the Client's cancellation, upon expiry of the subscription due to non-payment, upon successful completion of switching to another provider under the Data Act or upon expiry of the switching notice period, and in the cases of termination provided for in the Terms.

12.1a. Non-compliance. If Paysera is unable to comply with this DPA, it informs the Client without delay, and the Client may suspend the processing concerned. The Client may terminate the Agreement with immediate effect if Paysera does not restore compliance within a reasonable time and in any event within one month, if Paysera is in substantial or persistent breach of this DPA, or if Paysera fails to comply with a binding decision of a court or the Supervisory Authority concerning its obligations under the GDPR; in that case clause 8.2.3 of the Terms (pro-rata refund) applies. Paysera may terminate the Agreement if the Client insists on an Instruction that infringes data protection law after being informed under Section 16.

12.2. Return of data. At the Client's election, Paysera returns Client Data: within a data retrieval period of no less than 30 (thirty) calendar days from the end of the Service, the Client may export in the Console or via the integration API all exportable data and digital assets in a machine-readable, commonly used format (a ZIP archive of JSON files with a JSON Schema per dataset). The list of exportable data and digital assets is set out in clause 9.4 of the Terms and in item 7 of Annex No. 1.

12.3. Switching under the Data Act. In the event of the Client switching to another data processing service provider or to its own infrastructure, Paysera: (a) ensures continuity of the Service and provides reasonable assistance during the transitional period of 30 (thirty) calendar days; (b) the Client may extend the transitional period once; (c) no switching charges apply; (d) acts in good faith and cooperates with the new provider. The switching notice period and the consequences of early termination are set out in the Terms (Data Act Article 25, Article 29(4)).

12.4. Erasure. Subject to clause 12.5 and clause 9.5.2 of the Terms, upon expiry of the data retrieval period (or of the 30-day period under clause 11.7) the Client's account is archived and Client Data is kept in the archive, with its processing restricted to storage, during the archive retention period of 12 (twelve) months from archiving; operational Visitor data continues to be anonymised under clause 11.1. Within 30 (thirty) days after the end of the archive retention period Paysera erases all Client Data, including audit log entries, customer profile data, anonymised records relating to the Client; backups are erased within the rotation cycle specified in clause 11.6, and residual copies held by Sub-processors are deleted within the periods set in their data processing terms (for Google Cloud, within a maximum period of 180 days – section 6.1 of the Google Cloud Data Processing Addendum). Archiving (soft deletion) of the Client's account is not erasure within the meaning of this clause. The Client may request earlier erasure at any time, including by waiving the remainder of the data retrieval period; in that case Paysera erases Client Data within 30 (thirty) days of the request. At the Client's request, Paysera confirms the erasure in writing.

12.5. Exceptions (legal hold). Paysera continues to store Client Data beyond the time limits of clause 12.4 only in the following cases, and only the data concerned (clause 9.9.1 of the Terms): (a) required by law – to the extent and for as long as Union or Republic of Lithuania law to which Paysera is subject requires it, including a binding request or order of a law-enforcement or pre-trial investigation authority, a court or the Supervisory Authority; Paysera then acts as processor and informs the Client of that legal requirement before the processing, unless that law prohibits such information on important grounds of public interest (Article 28(3)(a) GDPR); a request that is not binding on Paysera is forwarded to the Client, unless the law prohibits it; (b) on the Client's Instruction – where, before erasure, the Client instructs Paysera to preserve specified data for its own claim, dispute or investigation; Paysera then acts as processor and erases the data on the Client's further Instruction or once the period set by the Client ends; (c) Paysera's own legal claims – where a claim or dispute between Paysera and the Client or a third party concerning the Service is pending or reasonably expected, Paysera may keep the data strictly necessary for the establishment, exercise or defence of that claim; for this purpose Paysera acts as an independent controller (in addition to clause 2.2), on the basis of Article 6(1)(f) and Article 17(3)(e) GDPR, uses the data for no other purpose and informs the Client of the retention unless the law prohibits it. In all cases the data are isolated, their processing is restricted to storage (except their provision to the authority or court concerned or their use for the claim concerned) and they are erased once the purpose ends; in cases (a) and (b) this DPA continues to apply to them. Anonymised statistical data (clause 11.2) and data in respect of which Paysera is an independent controller (clause 2.2) are not governed by this Section.

12.6. Survival. Sections 6, 12, 15 and 17 of the DPA remain in force until the complete deletion or return of Client Data.

Legal basis: GDPR Article 28(3)(a) and (g); Article 20; Article 17, including Article 17(3)(e); Article 18(2); Data Act Article 23, Article 25, including Article 25(2)(h) (erasure after an alternative agreed period ending later than the retrieval period – the archive retention period), Article 27, Article 29(1) and (4), Recital 89; CK Articles 6.217, 6.218, 6.221; Code of Criminal Procedure of the Republic of Lithuania (BPK) Articles 97 and 155. Clause 12.5: in case (a) (retention required by Union or Member State law) and in case (b) (retention on the Client's Instruction) Paysera acts as processor (Article 28(3)(a) GDPR); in case (c) (Paysera's own legal claims) Paysera acts as an independent controller on the basis of Article 6(1)(f) and Article 17(3)(e) GDPR – that role is agreed in this DPA and does not arise from processing beyond the Client's Instructions within the meaning of Article 28(10) GDPR. Informing the Client under clause 12.5(c) is a contractual undertaking that the GDPR does not itself require; Paysera's own obligation as controller to inform the data subjects (Article 14 GDPR, including the exception in Article 14(5)(b)) is not affected.

13. AUDITS AND INSPECTIONS

13.1. Paysera makes available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Client or another auditor mandated by the Client.

13.2. First tier – information. The Client first uses the documents provided by Paysera: this DPA and its Annexes (in particular Annex No. 2), answers to the Client's reasonable security questionnaire (no more than once a year), a summary of the most recent independent penetration test of the Service (once one has been performed), and the third-party audit reports and certificates of Sub-processors (in particular Google Cloud – ISO/IEC 27001, SOC 2), which Paysera provides or makes available subject to confidentiality. At the time of this version the Service itself holds no independent certification.

13.3. Second tier – audit. If the information referred to in clause 13.2 is reasonably insufficient, the Client has the right to conduct an audit no more than once every 12 months, upon written notice of no less than 30 calendar days, having agreed with Paysera the scope, plan, duration and auditor. The audit is conducted during Paysera's business hours without disrupting the Service for other clients; the auditor must not be a competitor of Paysera and signs a confidentiality undertaking before the audit. The audit does not extend to other clients' data, Paysera's internal financial information or physical access to Sub-processors' data centres – Sub-processors' compliance is evidenced by their third-party audit reports.

13.4. Exceptions. The limitations on frequency and notice period do not apply where an audit is necessary due to a Breach, a binding demand of the Supervisory Authority or reasonable, documented evidence that Paysera is not complying with the DPA.

13.5. Costs and results. Each Party bears its own audit costs; a reasonable fee agreed in advance may be charged for Paysera staff time exceeding 8 (eight) hours per audit, except in the cases under clause 13.4 where breaches by Paysera are established. The audit report is provided to Paysera; Paysera remedies any identified non-conformities within a reasonable period agreed by the Parties.

13.6. Paysera makes the information under this Section, including audit results, available to the Supervisory Authority on request.

Legal basis: GDPR Article 28(3)(h); Article 28(5); Article 5(2); Article 58(1).

14. INTERNATIONAL DATA TRANSFERS

14.1. Client Data is stored and processed in the European Union – in the Google Cloud region europe-west1 (Belgium). Paysera does not process Client Data outside the European Economic Area and does not transfer it to a third country or an international organisation unless at least one safeguard under Chapter V GDPR applies:

a) a European Commission adequacy decision (Article 45 GDPR);

b) standard contractual clauses approved by the European Commission under Implementing Decision (EU) 2021/914, the relevant module (Article 46(2)(c) GDPR), together with a transfer impact assessment and, where necessary, supplementary measures (judgment of the CJEU of 16 July 2020 in Case C‑311/18 Schrems II);

c) another appropriate safeguard provided for in Article 46(2) or (3) GDPR.

14.2. The Client permits such transfers to the extent necessary for the Sub-processor's service (e.g., the Sub-processor's technical support access from a third country) and carried out with the safeguards referred to in clause 14.1; remote technical support by Google Cloud is provided under the Google Cloud Data Processing Addendum and its safeguards. Transfers are specified in Annex No. 3. Access to Client Data from outside the EEA by other Paysera group companies: none. No other Paysera group company has access to Client Data from outside the EEA; any such access would require the engagement of a new Sub-processor under Section 8 and a transfer complying with Chapter V GDPR.

14.3. In accordance with Article 28 of the Data Act, Paysera publishes on its website [● – address; the page is still to be published] information on the jurisdiction to which the ICT infrastructure used for the Service is subject and on the measures adopted to prevent unlawful access to data by third-country governmental authorities.

14.4. Upon receipt of a request from a third-country governmental authority for access to Client Data, Paysera shall, to the extent permitted by law, inform the Client, challenge the request if it does not comply with Union law, and disclose only the minimum amount required (Data Act Article 32; GDPR Article 48).

Legal basis: GDPR Article 28(3)(a); Articles 44–46, Articles 48–49; Commission Implementing Decision (EU) 2021/914; Data Act Articles 28 and 32; CJEU Case C‑311/18.

15. LIABILITY

15.1. The Parties' liability towards data subjects is determined under Article 82 GDPR: Paysera is liable for damage caused by processing only where it has not complied with the obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the lawful Instructions of the Client. A Party is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

15.2. Where both Parties are responsible for the same damage and one of them has paid full compensation to the data subject, it is entitled to claim back from the other Party that part of the compensation corresponding to the latter's part of responsibility (Article 82(5) GDPR).

15.3. The Parties' mutual liability under this DPA is subject to Section 14 of the Terms, including the separate limit in clause 14.5(c) of the Terms; the limitations do not apply to intent or gross negligence and do not restrict the rights of data subjects under Article 82 GDPR.

15.4. Each Party bears the administrative fines imposed on it by the Supervisory Authority (Article 83 GDPR). A Party has the right to claim from the other Party reimbursement of the amount of a fine or compensation only to the extent that the fine or compensation was imposed as a result of the other Party's breach of the DPA; liability for a fine requires fault on the part of the Party (judgment of the CJEU of 5 December 2023 in Case C‑683/21).

15.5. Paysera is liable to the Client for the acts of Sub-processors as for its own (Article 28(4) GDPR).

15.6. A Party that receives a claim from a data subject or the Supervisory Authority relating to Client Data shall inform the other Party within 5 (five) business days and cooperate in handling it.

Legal basis: GDPR Article 82(1)–(5); Article 83; Article 28(4); CK Articles 6.245–6.249, Article 6.251, Article 6.256, Article 6.258; CJEU Case C‑683/21.

16. PROCESSOR'S DUTY TO INFORM OF AN UNLAWFUL INSTRUCTION

16.1. Paysera shall immediately inform the Client if, in its opinion, an Instruction infringes the GDPR, the ADTAĮ or other Union or Republic of Lithuania data protection provisions.

16.2. Paysera has the right to suspend execution of the disputed Instruction until the Client confirms, amends or withdraws it in writing. Once the Client has confirmed the Instruction in writing, responsibility for its lawfulness rests with the Client; Paysera nevertheless retains the right to refuse to execute an Instruction whose execution would constitute a manifest infringement of the GDPR.

16.3. This duty does not mean that Paysera is obliged to provide legal advice to the Client or to systematically verify the lawfulness of the Client's processing; the Client remains responsible for the lawfulness of its Instructions.

Legal basis: GDPR Article 28(3), second subparagraph; Article 28(10); Article 29.

17. GOVERNING LAW, DISPUTES AND SUPERVISION

17.1. This DPA and the relations arising from it are governed by the law of the Republic of Lithuania. The GDPR and the Data Act apply directly; their mandatory provisions take precedence over the DPA.

17.2. The Parties shall resolve disputes by negotiation within 30 (thirty) calendar days of receipt of a written claim. If no agreement is reached, the dispute shall be resolved in the manner set out in Section 18 of the Terms – in the courts of the Republic of Lithuania according to the location of Paysera's registered office in Vilnius.

17.3. The competent supervisory authority in Lithuania is the State Data Protection Inspectorate (vdai.lrv.lt). The Client, as Controller, is responsible for communication with the Supervisory Authority; Paysera cooperates with the Supervisory Authority in accordance with Article 31 GDPR.

17.4. The DPA is concluded in the Lithuanian language and is provided with an English translation; in the event of any discrepancy the Lithuanian text prevails.

Legal basis: GDPR Article 31, Articles 55–56, Article 77, Article 79; ADTAĮ Article 7; CK Article 1.37(1), Article 6.193; Articles 29 and 32 of the Code of Civil Procedure of the Republic of Lithuania (CPK).

18. FINAL PROVISIONS

18.1. Notices under the DPA are given by e-mail: to the Client – to the Administrators' addresses specified in the Console; to Paysera – dpo@paysera.com (data protection matters) and qms@paysera.com (other Service matters); notices concerning Breaches, Sub-processors and document versions are additionally displayed in the Console. The Client is responsible for keeping the Administrators' contact details up to date.

18.2. Contact details of Paysera's data protection officer: dpo@paysera.com (Articles 37–39 GDPR).

18.3. If any provision of the DPA is held invalid, the remaining provisions remain in force, and the invalid provision is replaced by a lawful provision closest to it in its economic and legal effect (CK Article 1.96).

18.4. Paysera maintains the records of processing activities carried out on behalf of the Client provided for in Article 30(2) GDPR and makes them available to the Client or the Supervisory Authority on request.

18.5. In the event of changes in legislation, the Parties shall agree amendments to the DPA in good faith in the manner set out in clause 2.4.

Legal basis: GDPR Article 28(9); Article 30(2); Articles 37–39; CK Article 1.96, Article 6.189, Article 6.200.

ANNEX NO. 1. DESCRIPTION OF PROCESSING

ANNEX NO. 2. TECHNICAL AND ORGANISATIONAL MEASURES (ARTICLE 32 GDPR)

ANNEX NO. 3. LIST OF SUB-PROCESSORS

Notes:

1. The list is updated in the manner set out in Section 8 of the DPA; Administrators are notified of changes by e-mail no later than 30 days in advance.

2. The identity provider chosen by the Client, Google as the provider of "Sign in with Google", Paysera as payment service provider via "Paysera Checkout" and integrations connected independently by the Client are not Paysera's Sub-processors (clause 8.6 of the DPA).

3. Application error monitoring runs in a Sentry system operated by Paysera itself (sentry.paysera.com) [● confirm which Paysera company operates it and where it is hosted]; if it is not operated by Paysera LT, UAB, it must be added to this list.

4. SMS and WhatsApp notifications to Visitors, once offered, will be sent through Paysera's own messaging system LightSMS and only for Clients who enable them [● confirm which Paysera company operates LightSMS and where it is hosted]; if it is not operated by Paysera LT, UAB, it is listed in this Annex from the outset as a Sub-processor used only for those Clients, so that enabling the function requires no new notice under clause 8.2.

5. Version of this Annex: 0.2-draft.