Last Updated: 13.07.2026

Data Processing Agreement (DPA)

This Data Processing Agreement ("Agreement" or "DPA") is entered into between:

BLUE SKY SOFTWARE LTD, registered at Archiepiskopou Makariou III, 59, MOUYIAS TOWER,

6017, Larnaca, Cyprus ("Processor" or "Superhack"), and the customer identified in the applicable Order Form ("Controller" or "Customer"),

Each a "Party" and collectively the "Parties".

This DPA forms part of and is subject to the Master Subscription Agreement ("MSA") between the Parties and reflects the Parties' agreement with respect to the processing of personal data by Superhack on behalf of Customer.

1. Subject Matter and Purpose

The subject matter of this Agreement is the processing of personal data by Superhack on behalf of Customer for the purpose of providing the Superhack SaaS platform, which performs autonomous, AI-driven penetration testing against the Customer's authorized systems, applications, and infrastructure to identify security vulnerabilities and help the Customer remediate them.

2. Duration

This Agreement remains in effect for as long as Superhack processes personal data on behalf of the Customer under the MSA.

3. Nature and Purpose of Processing

Superhack processes personal data for the following purposes:

1. To provide and maintain the Superhack SaaS platform and its features.
2. To perform security testing and to generate reports and findings on the Customer's authorized targets.
3. To provide support and communicate with the Customer.
4. To fulfill legal obligations and protect Superhack's legitimate interests.

4. Categories of Data Subjects

• Authorized Users of the Customer's Superhack account, and any individuals whose personal data may incidentally be present within the Customer's systems that are subject to authorized testing.