Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between VMease Limited, a company registered in Jersey ("VMease"), and the customer identified in the applicable VMease Software Order Form (the "Customer"), for the supply of VMease software and services (the "Agreement").

1. When this DPA applies

The VMease platform runs in infrastructure controlled by the Customer or its partner, and VMease does not access Customer data in normal operation.

This DPA covers the occasions when VMease, as a Data Processor, processes personal information on a customer's behalf, principally during installation, migration, diagnostics and support, where these involve access to personal data controlled by the Customer ("Customer Personal Data").

It does not cover how VMease collects, uses, stores and shares personal information, as a Data Controller, for its own business purposes, including sales, licensing, customer administration, website analytics and business communications. This is covered by our Privacy Policy rather than this agreement.

2. Details of the processing

3. VMease's obligations

VMease will:

• Process Customer Personal Data only in accordance with the documented instructions set out in this DPA, the Agreement and any additional instructions provided by the Customer, unless otherwise required by applicable law.
• Make sure everyone authorised to process it is bound by confidentiality
• Implement appropriate technical and organisational measures to ensure the security of Customer Personal Data proportionate to the risks associated with the processing of that data.
• Help the Customer respond to requests from individuals exercising their rights
• Help the Customer with security, breach notification and data protection impact assessments, taking into account the nature of the processing
• Make available the information needed to show compliance with this DPA, and allow reasonable audits as set out in clause 8

4. Subprocessors

The Customer gives general authorisation for VMease to use the subprocessors in its published Subprocessor List. VMease will give notice of any new or replacement subprocessor, and the Customer may object on reasonable data protection grounds. VMease will put equivalent data protection terms in place with each subprocessor and remains responsible for their performance.

5. International transfers

VMease will not transfer Customer Personal Data outside Jersey, the United Kingdom or the European Economic Area unless the destination has an adequacy decision, or appropriate safeguards such as standard contractual clauses are in place.

6. Personal data breaches

VMease will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information then available to help the Customer meet its own obligations.

7. Return and deletion

When the services end, VMease will, at the Customer's choice, delete or return any Customer Personal Data it holds, including diagnostic files, logs, configuration output and other information obtained from the Customer's environment, and delete any remaining copies, unless the law requires it to be kept.

This does not apply to VMease's own support administration records, such as support tickets, case histories and the business contact details of Customer staff who raise them, which VMease holds as Data Controller and keeps in line with its Privacy Policy.

8. Audits

VMease will make available to the Customer the information necessary to demonstrate compliance with its obligations under applicable data protection law and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor appointed by the Customer, as required by applicable data protection law.

9. Liability and law

The limitations of liability in the Agreement apply to this DPA, to the extent permitted by applicable law. This DPA is governed by the law specified in the applicable VMease Software Order Form.

Version: 1.0 · Published: 28 October 2026