Data Processing Addendum

Last updated 24 October 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Customer”, the controller) and Ayshan Huseynova, a sole proprietor registered in the Republic of Azerbaijan (VÖEN 6501887942), trading as Bindseal (“Bindseal”, the “Processor”) for your use of the Service, and applies where we process personal data on your behalf. Capitalized terms not defined here have the meaning given in the Terms of Service. Where the GDPR applies, terms such as “controller”, “processor”, “personal data” and “processing” carry their GDPR meaning.

1. Roles

For personal data about your end users processed through the Service (for example license and activation records), you are the controller and we are your processor. For your account and billing relationship with us, each party acts as an independent controller. Payment data is handled by Paddle as an independent controller and is outside the scope of this DPA.

2. Scope of processing

• Subject matter: provision of the licensing and anti-tamper Service.
• Duration: for the term of your use of the Service, plus any retention required by law.
• Nature and purpose: issuing, signing, storing and verifying license records and enforcing entitlements on your instructions.
• Types of personal data: product and account identifiers, hashed machine fingerprints, seat/entitlement metadata, and limited technical logs. The Service is designed to minimize personal data; most records are pseudonymous.
• Categories of data subjects: your end users and licensees.

3. Our obligations

• We process personal data only on your documented instructions, including as set out in the Terms and your configuration, unless law requires otherwise (and then we tell you, where permitted).
• We ensure people authorized to process the data are bound by confidentiality.
• We implement appropriate technical and organizational security measures (Section 5).
• We assist you, taking into account the nature of processing, with data subject requests and with your obligations around security, breach notification and impact assessments.

4. Sub-processors

You authorize us to engage the sub-processors needed to run the Service:

• Amazon Web Services — KMS key storage and signing (EU).
• Neon — managed PostgreSQL for license records (EU, Frankfurt).
• Fly.io — license-server hosting (EU, Frankfurt).

We impose data-protection obligations on each sub-processor no less protective than this DPA, and remain responsible for their performance. We will give you reasonable prior notice of any new or replacement sub-processor so you can object on reasonable data-protection grounds.

5. Security

Measures include: signing keys held in a hardware security module and never exported; encryption in transit and at rest; least-privilege access with scoped admin tokens; logging and monitoring; and regular review. These measures are described further in our Privacy Policy and are designed so that compromising our systems does not expose your signing key.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, and provide information reasonably available to help you meet your own notification obligations.

7. Data subject requests

If we receive a request from one of your end users to exercise their rights, we will, where legally permitted, refer them to you and assist you in responding, taking into account the nature of the processing.

8. Return and deletion

On termination, and at your choice, we will delete or return the personal data we process for you, and delete existing copies, except where law requires retention. You can also export your license records yourself at any time.

9. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, allow for and contribute to audits, including through up-to-date third-party reports where available.

10. International transfers

Where we transfer personal data outside the EEA, UK or your region, we rely on an appropriate transfer mechanism such as the European Commission’s Standard Contractual Clauses, which are incorporated by reference where applicable.

11. Precedence

If there is a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls. This DPA does not expand either party’s liability beyond the limits in the Terms, except where applicable law requires.

12. Contact

Data-protection queries and this DPA: dpo@bindseal.com.