Version 2.3

Date: 17/06/2026

<aside> 📝

Does the Data Processing Agreement need to be signed separately by an authorised representative of your organisation?

• Download the PDF version here. </aside>

This Data Processing Agreement ("Processing Agreement") is an annex to the General Terms and Conditions and forms part of the agreement ("Agreement") between the customer ("Controller") and dembrane B.V. ("Processor"). This Processing Agreement governs the processing of personal data by dembrane on behalf of the Controller. Capitalised terms have the meaning as defined in the General Terms and Conditions (Article 1), unless otherwise defined in this Processing Agreement.

For the purposes of Article 28(3) of the GDPR, the Controller and Processor (each a "Party", together the "Parties") have agreed on the following terms to ensure the protection of the rights of Data Subjects.

Recitals

• As part of the performance of the Agreement, Personal Data will be processed by Processor on behalf of Controller.
• Pursuant to Article 28 of the GDPR, the arrangements regarding the processing and security of such Personal Data must be laid down in a data processing agreement.
• The Parties have laid down these arrangements in this Processing Agreement.

Article 1. Definitions

Terms used in this Processing Agreement written with an initial capital letter shall have the following meanings:

• Data Subject: the person to whom Personal Data relates.
• Personal Data: any information about an identified or identifiable natural person processed by Processor in the context of the performance of the Agreement with Controller.
• GDPR: the EU General Data Protection Regulation 2016/679.
• AI Act: The EU Artificial Intelligence Act, Regulation (EU) 2024/1689.

Article 2. Processing of Personal Data

2.1. The categories of Data Subjects and types of Personal Data processed by Processor are set out in Annex I.