Data Processing Addendum

"Customer Personal Data" means personal data that a customer submits to Mercur or makes available through tunnel traffic, request logs, proxy configuration, support requests, or other use of the service, where Mercur processes that data on behalf of the customer.

"Data Protection Laws" means GDPR, UK GDPR, ePrivacy rules, US state privacy laws, and other privacy or data protection laws that apply to the processing.

"Process" and related terms have the meanings given under applicable Data Protection Laws.

"Subprocessor" means a third party engaged by Mercur to process Customer Personal Data on behalf of the customer in connection with the service.

For Customer Personal Data, the customer is the controller or processor, and Mercur is the processor or subprocesser. For account, billing, security, website analytics, and business operations data, Mercur may act as an independent controller as described in the Privacy Policy.

Mercur will process Customer Personal Data only to provide, secure, support, maintain, and improve the service; comply with the Terms and this DPA; follow documented customer instructions; and comply with law.

Customer instructions include the Terms, product settings, API or dashboard actions, agent configuration, startup modes, and written instructions accepted by Mercur.

Mercur will use reasonable technical and organizational measures designed to protect Customer Personal Data against unauthorized access, loss, alteration, disclosure, and destruction.

Personnel and contractors with access to Customer Personal Data must be subject to confidentiality obligations. Access should be limited based on operational need.

Customer provides general authorization for Mercur to engage subprocessors to assist in providing the service, including hosting, networking, databases, caching, storage, security, support, billing, analytics, and related operations.

A current list of subprocessors is published at /subprocessors. Mercur will notify customers of changes to that list by updating the Subprocessors page. Customers who want email notice of changes may contact Mercur using the address in the Contact section.

Mercur remains responsible for subprocessors that process Customer Personal Data on Mercur's behalf and will impose data protection obligations on those subprocessors that are no less protective than those in this DPA.

The customer is responsible for responding to data subject requests relating to Customer Personal Data. Mercur will provide reasonable assistance through available product controls and cooperation appropriate to the nature of the service.

If Mercur receives a request relating to Customer Personal Data, Mercur may direct the requester to the customer unless legally required to respond directly.

Mercur will notify affected customers without undue delay after confirming a personal data breach affecting Customer Personal Data, where required by law.

Notices will include, to the extent reasonably available at the time, a general description of the nature of the breach and the measures taken or proposed to address it. Additional information may follow as it becomes reasonably available.

The customer remains responsible for notifying relevant supervisory authorities and affected data subjects where required under applicable Data Protection Laws, and for determining whether a breach is notifiable.

Upon account closure or written request, Mercur will delete or return Customer Personal Data where feasible, subject to product functionality, legal obligations, security needs, backups, billing records, and legitimate business records.

Mercur's primary application and relay infrastructure and associated self-hosted data stores are located in the European Union (DigitalOcean Frankfurt — FRA1).

Where Customer Personal Data is transferred outside the EEA through a subprocessor or another lawful processing activity, Mercur will ensure appropriate safeguards are in place, such as an adequacy decision (including the EU-US Data Privacy Framework where applicable) or Standard Contractual Clauses adopted by the European Commission.

Mercur satisfies its obligation to make available information necessary to demonstrate compliance with this DPA through the publication of this DPA, the Privacy Policy, the Security page, and the Subprocessors page.

Because Mercur is an early-stage startup, no SOC 2, ISO 27001, or similar certification is promised unless separately stated in writing. On-site audits, custom questionnaires, and individual compliance assessments are not available on self-serve plans. Enterprise customers needing expanded audit rights should contact Mercur to discuss a custom agreement.

Customer is responsible for lawful instructions, notices, consents, endpoint configuration, security of exposed services, token management, and deciding whether request logging is appropriate for the data being processed.

Data protection questions may be sent to development@mercur.sh. Operator: Mercur, Khreschatyk St, 1, Kyiv, Ukraine.