Data Processing Agreement

Last updated: October 28, 2026

1. Introduction & Definitions

This Data Processing Agreement ("DPA") governs the processing of personal data by Synthron AI Technologies on behalf of our enterprise customers using the Operon platform.

Data Controller

The "Data Controller" is the Company subscribing to Operon. The Controller determines the purposes and means of processing personal data regarding its Employees and Customers.

Data Processor

Synthron AI Technologies acts as the "Data Processor" providing the Operon SaaS platform. We process personal data solely on the documented instructions of the Data Controller.

2. Security Measures

The Processor implements rigorous technical and organizational Security Measures to ensure a level of security appropriate to the risk. This includes encryption of data in transit (TLS) and at rest, access controls, and regular vulnerability assessments.

3. Confidentiality

The Processor ensures that persons authorized to process the personal data have committed themselves to strict Confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

4. Subprocessors

The Controller authorizes the Processor to engage third-party Subprocessors (e.g., AWS, cloud infrastructure providers) to assist in delivering the services. The Processor will notify the Controller of any intended changes concerning the addition or replacement of Subprocessors.

5. Breach Notification

In the event of a confirmed personal data breach, the Processor will notify the Data Controller without undue delay (typically within 48 hours). We will provide sufficient information to allow the Controller to meet any obligations to report the breach to authorities or affected individuals.

6. Data Deletion & Data Return

Upon termination of the SaaS agreement, the Processor shall, at the choice of the Controller, perform complete Data Deletion or facilitate Data Return (via secure export) of all personal data, deleting existing copies unless local law requires storage of the personal data.

7. International Transfers

If personal data is transferred across international borders, the Processor ensures compliance with applicable data protection laws, utilizing standard contractual clauses or equivalent legal frameworks to guarantee adequate protection during International Transfers.

8. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.