Data Processing Agreement

Annex No. 1 to the General Terms and Conditions of PNH LIMITLESS s.r.o. | concluded pursuant to Art. 28(3) of Regulation (EU) 2016/679 (GDPR)

Version: 1.0 | Effective from: 22 October 2026

English translation for information. In case of any discrepancy, the Czech version prevails.

Art. 1 Contracting Parties

1.1Controller: the Client, as identified in the Contract (the "Controller").

1.2Processor: PNH LIMITLESS s.r.o., Company ID (IČO): 30029805, registered office Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 456086, data protection contact: [email protected] (the "Processor").

1.3This agreement (the "DPA") is Annex No. 1 to the GTC and is concluded together with the Contract. Capitalised terms have the meaning given in the GTC. The terms "personal data", "processing", "data subject", "personal data breach" and other terms have the meaning given in Art. 4 GDPR.

1.4Order of precedence: in matters of personal data protection, the DPA prevails over the GTC and the Contract. The parties may agree deviations for a specific engagement in a written annex to the Contract.

Art. 2 Subject Matter and Purpose of Processing

2.1The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Services under the Contract, to the extent and for the period necessary to provide them.

2.2The specific subject matter of processing is determined by the Services ordered by the Controller:

Service	Processing activities	Categories of personal data	Categories of data subjects
Performance marketing	management of advertising accounts, creation and upload of custom audiences, setup and management of pixels, conversion APIs and measurement, reporting	email and telephone number in hashed form, device and cookie identifiers, IP address, data on website behaviour and conversions, demographic and interest data provided by the Advertising Platform	customers, potential customers and website visitors of the Controller
Website and e-shop development	development, testing, data migration, form management, deployment	identification and contact data, addresses, order and payment data (without full payment card numbers), content of messages from forms, user accounts	e-shop customers, website users, form submitters
AI solutions	configuration of chatbots and automations, integrations, tuning, monitoring	content of conversations and queries, contact data, metadata	chatbot users, customers and employees of the Controller
Software, CRM and Hosting	development, operation, storage, backup, support, migration	data stored by the Controller in the CRM or application, in particular identification, contact and business data, communications, user login credentials	customers, business partners, potential customers and employees of the Controller
Consulting and design	analysis of data provided by the Controller, training	data contained in the Controller's materials	as per the materials

2.3The Processor does not process special categories of personal data under Art. 9 GDPR or personal data relating to criminal convictions under Art. 10 GDPR, unless expressly agreed in an annex to the Contract with appropriate safeguards added. A Controller in the healthcare sector (for example dentistry, health consultancy) must notify the Processor in advance if data from healthcare websites, pixels or forms may reveal information about health, and must configure measurement so that no health data is passed to Advertising Platforms. For Controllers in the healthcare sector, Annex C also applies.

2.4Nature of processing: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure to Advertising Platforms on the Controller's instruction, alignment, combination, restriction, erasure and destruction, both automated and manual.

Art. 3 Duration

3.1The DPA is concluded for the term of the Contract. Obligations that by their nature are meant to continue, in particular Art. 6 and Art. 11, continue after its termination for as long as the Processor processes the Controller's personal data.

Art. 4 Controller's Instructions

4.1The Processor processes personal data only on the basis of documented instructions from the Controller. Documented instructions are the Contract, the GTC, this DPA, the Specification and instructions given by the Controller's contact person by email or in the project management tool.

4.2If the Processor is required to process personal data under EU or Member State law, it informs the Controller of this before processing, unless that law prohibits it.

4.3If the Processor believes that an instruction infringes the GDPR or other data protection legislation, it notifies the Controller without delay and is entitled to suspend carrying out the instruction until it is confirmed or changed. The Processor does not provide legal advice to the Controller, and its notification does not relieve the Controller of responsibility.

Art. 5 Controller's Obligations

5.1The Controller is responsible for ensuring that:

(a) it has a valid legal basis for the processing under Art. 6 GDPR and, in the case of cookies and similar technologies, valid consent under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, or Section 109 of Act No. 452/2021 Coll. on Electronic Communications (Slovakia) for Slovak users,
(b) it has fulfilled its duty to inform data subjects under Art. 13 and 14 GDPR, including information about the passing of data to Advertising Platforms,
(c) it has concluded the relevant terms with the Advertising Platforms (for example Meta Business Tools Terms, Google Ads Data Processing Terms, LinkedIn Ads Agreement) and configured the relevant settings (for example Consent Mode v2, restricted data processing),
(d) the data it passes to the Processor is accurate and was obtained lawfully.

5.2In relation to Advertising Platforms, e-commerce platforms and other services where the Controller has its own Account and contractual relationship (in particular Meta, Google, LinkedIn, TikTok, Shopify), the Controller acts as controller and the relevant platform acts as processor or as independent or joint controller under its terms. These platforms are not Subcontractors of the Processor for processing purposes. The Processor acts in them as a user with access granted by the Controller.

Art. 6 Processor's Obligations

6.1The Processor undertakes to:

(a) process personal data only in accordance with Art. 4,
(b) ensure that persons authorised to process personal data (employees, collaborators, Subcontractors) have committed themselves to confidentiality or are under a statutory obligation of confidentiality, including after the end of the cooperation,
(c) implement the technical and organisational measures under Art. 32 GDPR set out in Annex B,
(d) comply with the conditions for engaging a sub-processor under Art. 7,
(e) provide the Controller with assistance under Art. 8 and 9,
(f) erase or return personal data after the end of processing under Art. 11,
(g) provide the Controller with the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allow audits under Art. 10,
(h) not use the Controller's personal data for its own purposes, in particular for its own marketing, for training AI models or for enriching other datasets,
(i) keep records of categories of processing activities carried out for the Controller under Art. 30(2) GDPR.

6.2The Processor does not enter the Controller's personal data into AI Systems, unless this is necessary for performance, the AI System is listed in Annex A and its provider has contractually undertaken not to use the data for model training. The Processor does not use the Controller's personal data to create AI creative content (images, video); it processes the likeness of real persons only on the Controller's written instruction, which documents the legal basis (in particular the consent of the person depicted).

Art. 7 Sub-processors

7.1The Controller grants the Processor a general authorisation to engage sub-processors. The list of approved sub-processors as of the effective date forms Annex A.

7.2The Processor informs the Controller of any intended addition or replacement of a sub-processor by email at least 14 days in advance. The Controller may object to the change by email within 14 days of the notice, on legitimate grounds relating to personal data protection. If the parties do not agree on a solution within 30 days of the objection, either party may terminate the affected Service with a notice period of 1 month; until then, the Processor will not use the new sub-processor for the Controller's data, where technically possible.

7.3The Processor imposes on each sub-processor by contract the same personal data protection obligations as are set out in this DPA, in particular the obligation to provide sufficient guarantees to implement technical and organisational measures. The Processor is liable to the Controller for the performance of the sub-processor's obligations as if it had acted itself.

7.4In urgent cases (in particular an outage or security incident at an existing sub-processor), the Processor may replace a sub-processor immediately and informs the Controller afterwards; the right to object under Art. 7.2 remains unaffected.

Art. 8 Assistance with Data Subjects' Rights

8.1Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests to exercise data subjects' rights under Chapter III GDPR.

8.2If the Processor receives a request from a data subject concerning processing for the Controller, it forwards the request to the Controller within 3 Business Days and does not respond to it on the merits itself, unless instructed to do so by the Controller.

8.3The Processor is entitled to charge assistance exceeding 2 hours per month at the Hourly Rate, unless the request arose as a result of the Processor's breach of its obligations.

Art. 9 Security and Personal Data Breaches

9.1The Processor assists the Controller in ensuring compliance with the obligations under Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to it, including assistance with data protection impact assessments and prior consultation.

9.2If the Processor becomes aware of a personal data breach concerning personal data processed for the Controller, it notifies the Controller without undue delay, and no later than 48 hours after becoming aware of it, at the email address of the Controller's contact person.

9.3The notification contains, where possible at that time: a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, a contact person, a description of the likely consequences and a description of the measures taken or proposed. The Processor supplements information that is not yet available gradually and without undue delay.

9.4The Processor promptly takes reasonable measures to limit the consequences of the breach and documents all breaches. Notification to the supervisory authority and to data subjects is made by the Controller; the Processor does not make it without the Controller's instruction, unless required to do so by law.

Art. 10 Audits and Inspections

10.1At the Controller's request, the Processor provides within 15 Business Days the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular a completed security questionnaire, a description of the measures and a list of sub-processors.

10.2If the information under Art. 10.1 is not sufficient, the Controller may carry out an audit, either itself or through an independent auditor bound by confidentiality who is not a competitor of the Processor, at most once every 12 months (except in the event of a personal data breach or an inspection by a supervisory authority), on at least 30 days' notice, during normal business hours, without disrupting the Processor's operations and without access to the data of other customers.

10.3The Controller bears the costs of the audit, including the Processor's time charged at the Hourly Rate, unless the audit proves a material breach of the DPA by the Processor.

10.4An audit of sub-processors (in particular cloud providers) is carried out through their certifications and audit reports (for example ISO/IEC 27001, SOC 2), which the Processor makes available to the Controller on request to the extent possible.

Art. 11 Erasure and Return of Personal Data

11.1After the end of the provision of Services that involve processing, the Processor, at the Controller's choice notified by email within 15 days of the end, returns the personal data in a structured, commonly used and machine-readable format or erases it. If the Controller does not make a choice, the Processor erases the data 30 days after the end of the Services.

11.2Personal data in backups will be erased in the normal backup rotation cycle, no later than 90 days after the end of the Services. Until erasure, backups are protected in accordance with Annex B and are not actively processed.

11.3The Processor may retain personal data only to the extent required by EU or Member State law.

11.4At the Controller's request, the Processor confirms erasure by email.

Art. 12 Transfers to Third Countries

12.1The Processor primarily processes personal data in the European Economic Area (EEA). It transfers data to a third country or international organisation only on the Controller's instruction, which includes the engagement of a sub-processor listed in Annex A, and under the conditions of Chapter V GDPR (Art. 44 to 49).

12.2Transfers take place on the basis of:

(a) a European Commission adequacy decision (Art. 45 GDPR), in particular the EU-U.S. Data Privacy Framework for recipients in the USA that are certified under it, or
(b) standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR), supplemented by a transfer impact assessment and supplementary measures where needed.

12.3At the Controller's request, the Processor makes available information on the transfer mechanism for individual sub-processors.

Art. 13 Liability

13.1Each party is liable for damage caused by a breach of obligations under the GDPR and the DPA to the extent provided in Art. 82 GDPR. As between the parties, the limitation of liability under Art. 19 of the GTC applies, except for damage caused intentionally or by gross negligence and fines imposed by a supervisory authority as a result of a breach of obligations solely by the other party.

13.2The Controller is solely liable for breaches of the Controller's obligations under Art. 5 and indemnifies the Processor against third-party claims and sanctions arising as a result.

Art. 14 Final Provisions

14.1The DPA is governed by the law of the Czech Republic, the GDPR and Act No. 110/2019 Coll., on Personal Data Processing. Disputes are resolved in accordance with Art. 27 of the GTC.

14.2Amendments to the DPA, other than updates to Annex A under Art. 7, are made in accordance with Art. 26 of the GTC. The Processor is entitled to amend the DPA without the Controller's consent where necessary to meet the requirements of legislation or a decision of a supervisory authority.

14.3Contact for personal data protection matters: [email protected], tel. +420 722 221 445.

Annex A: List of Approved Sub-processors

Sub-processor	Purpose	Location / transfer outside the EEA
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace)	email, calendar, document storage, sharing of materials	EEA; possible transfer to the USA on the basis of the EU-U.S. DPF and SCCs
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	server hosting (CRM, applications and websites operated by the Processor)	Germany (Nuremberg), no transfer
Cloudflare, Inc., San Francisco, USA	hosting, CDN and protection of websites and applications	global network; transfer to the USA on the basis of the EU-U.S. DPF and SCCs
Vercel Inc., San Francisco, USA	hosting and deployment of websites and applications (React)	region depending on project settings; transfer to the USA on the basis of the EU-U.S. DPF and SCCs
GitHub, Inc., USA	management of Source Code and repositories	USA; EU-U.S. DPF / SCCs
Anthropic Ireland, Limited, Ireland	AI assistance in development and analysis and AI models for chatbots and automations (API), under commercial terms that exclude training models on customer data	EEA; transfer to the USA based on SCCs and the EU-U.S. DPF
OpenAI Ireland Ltd, Dublin, Ireland	AI models for chatbots and automations (API), without training models on customer data	EEA; transfer to the USA on the basis of the EU-U.S. DPF and SCCs
Plus Five Five, Inc. (Resend), San Francisco, USA	sending of transactional emails from applications	USA; EU-U.S. DPF and SCCs
Make (Celonis group)	automation and integration of systems (webhooks)	depending on the account zone: EU (eu1, eu2) with no transfer, USA (us1, us2) based on SCCs

The Processor does not use tools for generating AI creative content (for example Higgsfield, Kling AI) or for managing social media (Buffer) to process the Controller's personal data. Advertising Platforms and Shopify are not sub-processors under Art. 5.2. The Controller's e-shop on the Shopify platform is operated by the Controller on the Controller's own account.

Access control

access to personal data only for persons who need it for performance (principle of least privilege), granting and removing permissions without undue delay on a change of role or end of cooperation,
unique user accounts, mandatory two-factor authentication for email, repositories, cloud services and Advertising Platform Accounts,
access to the Controller's Accounts exclusively through delegated roles (Business Manager, MCC, Collaborator), not by sharing passwords; passwords are stored in a password manager,
quarterly review of access rights.

Encryption and pseudonymisation

encryption in transit (TLS 1.2 or higher) for all web services and APIs,
encryption at rest for cloud storage and disk encryption on work devices,
hashing (SHA-256) of contact data before uploading custom audiences to Advertising Platforms, where supported by the platform.

Infrastructure and application security

server infrastructure in EU data centres with ISO/IEC 27001 certification,
firewall, administrator access restricted to SSH keys, regular updates of the operating system and dependencies,
separation of development, test and production environments, testing on anonymised or synthetic data where feasible,
logging of access and administrator operations, logs retained for 90 days,
code review and checks of dependencies for known vulnerabilities.

Availability and recovery

daily backups of production databases retained for 30 days, stored separately from the production environment,
verification of restoration from backup at least once every 6 months,
monitoring of service availability.

Organisational measures

contractual confidentiality obligations of all employees and collaborators,
training of persons with access to personal data and to AI Systems (including AI literacy under Art. 4 of the AI Act) on joining and once a year,
security of work devices (encryption, screen lock, up-to-date operating system, antivirus),
security incident handling procedure with escalation and a register of personal data breaches,
vetting of sub-processors before engagement and conclusion of an agreement under Art. 28 GDPR,
erasure of data after the end of the engagement under Art. 11 of the DPA.

Annex C: Special terms for Controllers in healthcare

C.1This Annex applies where the Controller is a provider of healthcare services or health-related services (in particular dentistry, medical consultations and second opinions, laboratories, pharmacies, wellness with a therapeutic focus), or where the Processor processes for the Controller data from which the health status of individuals can be inferred.

C.2Measurement and advertising. The Processor configures measurement and advertising tools so that no health data is passed to Advertising Platforms, in particular:

URLs, page titles and event parameters must not contain the name of a diagnosis, procedure, treatment or doctor where this would make it possible to infer the health status of a specific person; the Processor uses generic event names (for example "form submitted", "appointment booking"),
the content of forms, messages and questionnaires is not passed to Advertising Platforms,
in Meta, the settings and restrictions for the health and wellness category apply, and in Google Ads the rules for advertising in healthcare and personalised advertising apply,
session recordings (Microsoft Clarity) are switched off on pages with forms and in booking systems, or their content is fully masked.

C.3Custom audiences. Lists of the Controller's patients or clients are uploaded to Advertising Platforms only on the Controller's written instruction, which documents the explicit consent of the persons concerned under Art. 9(2)(a) GDPR and Art. 6(1)(a) GDPR. Without such consent, the Processor does not create custom audiences from patient lists.

C.4Forms and bookings. The Processor designs forms that may contain health data so that the data is stored in the EEA, is encrypted in transit and at rest, and is accessible only to persons designated by the Controller. Health data is not entered into AI Systems unless the Controller instructs so in writing and documents the legal basis.

C.5Impact assessment. The Processor assists the Controller with a data protection impact assessment under Art. 35 GDPR, in particular by describing the data flows between the website, measurement tools and Advertising Platforms.

C.6Responsibility. The Controller is responsible for the legal basis for processing health data and for informing patients. The Processor is responsible for implementing and maintaining the settings under Art. C.2 to C.4 in accordance with the Controller's instructions.