Data Processing Addendum

This Data Processing Addendum ("DPA") supplements and forms part of the Yarotech Platform — Terms of Service (Tenant / Agency Agreement) (the "Agreement") between Yarotech ("Yarotech", "Processor") and the Tenant that has accepted the Agreement ("Tenant", "Controller", "you"). It governs Yarotech's processing of Personal Data on the Tenant's behalf. If there is a conflict, this DPA controls on data‑protection matters.

---

1. Definitions

Terms such as Personal Data, Processing, Controller, Processor, Sub‑processor, Data Subject, and Personal Data Breach have the meanings given in applicable data‑protection law ("Data Protection Laws"). "Tenant Personal Data" means Personal Data that Yarotech processes on the Tenant's behalf under the Agreement — including data relating to the Tenant's own Clients and their website visitors.

2. Roles and scope

• As between the parties, the Tenant (and/or its Client) is the Controller of Tenant Personal Data, and Yarotech acts as Processor (or sub‑processor) and processes Tenant Personal Data only to provide the Platform and on the Tenant's documented instructions (including as set out in the Agreement and this DPA).
• The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and the categories of Data Subjects are described in Annex A.

3. Tenant (Controller) obligations

The Tenant will: (a) comply with Data Protection Laws as a controller; (b) have a lawful basis and provide all required notices and obtain all required consents for the data it and its Clients submit to the Platform; and (c) ensure its instructions to Yarotech are lawful.

4. Yarotech (Processor) obligations

Yarotech will:

1. Process only on instructions. Process Tenant Personal Data only to provide the Platform and per the Tenant's documented instructions, unless required by law (in which case Yarotech will inform the Tenant where legally permitted).
2. Confidentiality. Ensure personnel authorized to process Tenant Personal Data are bound by confidentiality.
3. Security. Implement appropriate technical and organizational measures as described in Annex B.
4. Sub‑processing. Use Sub‑processors only under §6.
5. Assist the Tenant with: (a) responding to Data Subject requests (access, deletion, correction, portability, objection); (b) security, breach notification, data protection impact assessments, and prior consultations — taking into account the nature of processing and information available to Yarotech.
6. Breach notification. Notify the Tenant without undue delay after becoming aware of a Personal Data Breach affecting Tenant Personal Data, with the information reasonably available.
7. Deletion or return. On termination, delete or return Tenant Personal Data as described in §8.
8. Records and audits. Make available information reasonably necessary to demonstrate compliance and allow for audits under §7.

5. Data Subject requests

Yarotech will, to the extent legally permitted, promptly notify the Tenant if it receives a request from a Data Subject and will not respond directly except on the Tenant's instruction or as legally required. Yarotech will provide reasonable assistance (including through Platform functionality) to help the Tenant respond.

6. Sub‑processors

• The Tenant provides general authorization for Yarotech to engage Sub‑processors to provide the Platform. Current Sub‑processors are listed in Annex C.
• Yarotech will impose data‑protection obligations on each Sub‑processor that are materially no less protective than this DPA, and remains responsible for its Sub‑processors' performance.
• Yarotech will give the Tenant a way to learn of new Sub‑processors (for example, an updated list or notice) with a reasonable opportunity to object on reasonable data‑protection grounds.

7. Audits

Yarotech will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, by the Tenant or its mandated auditor, subject to reasonable confidentiality, security, frequency, scope, and notice conditions.

8. Deletion and return

On termination or expiry of the Agreement, and on the Tenant's request, Yarotech will delete or return Tenant Personal Data within a commercially reasonable period (typically within 90 days), and delete existing copies, except to the extent retention is required by law or for backup cycles (which are then protected and deleted on the ordinary schedule). The Platform's data‑export/migration functionality assists with return.

9. International transfers

The Platform and Tenant Personal Data are hosted in the United States. We do not transfer Tenant Personal Data internationally in a way that requires a specific transfer mechanism under the GDPR or UK GDPR. If this changes, we will put an appropriate transfer mechanism (such as Standard Contractual Clauses) in place.

10. Data location

The Platform and Tenant Personal Data are primarily hosted in the United States.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.

12. Term

This DPA takes effect on the effective date and remains in force for as long as Yarotech processes Tenant Personal Data under the Agreement.

---

Annex A — Details of processing

• Subject matter: provision of the Yarotech Platform (Web Agency dashboard, Web Agent client chat, hosting orchestration, and automated/AI website build and edit).
• Duration: the term of the Agreement plus any deletion/return period.
• Nature and purpose: hosting, building, editing, storing, transmitting, and displaying website content; delivering related notifications and support.
• Types of Personal Data: Tenant Users' names, emails, and login/2FA data; the Tenant's Clients' contact details; content submitted through the chat; and website-visitor form submissions and log/IP data.
• Categories of Data Subjects: Tenant Users; the Tenant's Clients and their personnel; visitors to the websites hosted on the Platform.

Annex B — Technical and organizational security measures

• Encryption of sensitive credentials at rest; TLS in transit.
• Mandatory two‑factor authentication for dashboard access; role‑based access control and per‑client scoping.
• Per‑tenant isolation of data and site files.
• Access controls, audit logging, and monitoring.
• Backups and the ability to revert website changes.

Annex C — Sub‑processors (current)

Category	Provider	Purpose	Location
Website hosting (cPanel)	cPanel hosting provider	Website hosting and file storage	United States
Transactional email	Transactional email provider	Platform and notification email delivery	United States
Content delivery & access/security	Content delivery & security provider	Secure delivery, TLS, access control	United States
Automated / AI processing	AI / LLM provider	Automated website build and edit assistance	United States

Annex D — Transfer mechanism

Not applicable — Tenant Personal Data is hosted in the United States; no cross-border transfer subject to the GDPR or UK GDPR is involved. If this changes, an appropriate transfer mechanism will be added here.