Title

1. Scope and Applicability

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between SyncRivo and the Customer. It applies to the extent SyncRivo processes Personal Data on behalf of the Customer.

2. Data Processing Roles

For the purposes of the GDPR and other applicable data protection laws, the Customer is the Controller and SyncRivo is the Processor of Personal Data.

3. Security Measures

SyncRivo implements appropriate technical and organizational measures to protect Personal Data, including:

• Encryption of data in transit and at rest
• Regular vulnerability assessments and penetration testing
• Access controls and authentication mechanisms
• Business continuity and disaster recovery plans

4. Data Subject Rights

SyncRivo shall, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject to exercise their rights (e.g., access, rectification, erasure).