Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions ("Agreement") between Sharpyield, Unipessoal Lda, a Portuguese private limited company with Tax ID (NIPC) 519641868 and registered office at Rua Major João Gomes, Lote 37, 1.º e 2.º, 2640-491 Mafra, Portugal ("Sharpyield", "Controller", "we", "us"), and the User ("Data Subject") and describes the processing of personal data carried out by Sharpyield and its sub-processors in the context of the Sharpyield service.

This DPA is provided for transparency purposes. It documents how Sharpyield, acting as data controller, engages third-party sub-processors to process personal data on its behalf, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.
• "Processing" means any operation performed on Personal Data, as defined in Art. 4(2) GDPR.
• "Controller" means Sharpyield, Unipessoal Lda, which determines the purposes and means of the Processing.
• "Processor" / "Sub-processor" means a third party that processes Personal Data on behalf of the Controller.
• "Data Subject" means the User whose Personal Data is processed.

2. Scope and Purpose of Processing

Sharpyield engages sub-processors to provide the Sharpyield service. The processing activities include:

3. Sub-processors

The Controller engages the following sub-processors. The Controller has entered into data processing agreements with each sub-processor that provide at least the same level of data protection as this DPA.

3.1. Infrastructure and Storage

3.2. Payments

3.3. AI Processing

3.4. Communications

3.5. Analytics and Monitoring

3.6. Market Data

4. Controller Obligations

The Controller shall:

4.1. Process Personal Data in accordance with the GDPR and applicable data protection laws;

4.2. Ensure that Data Subjects are informed about the processing, including through the Privacy Policy;

4.3. Respond to Data Subject rights requests within the timeframes specified in the GDPR;

4.4. Notify the relevant supervisory authority (CNPD) and affected Data Subjects of any personal data breach within the timeframes required by Articles 33 and 34 of the GDPR;

4.5. Conduct data protection impact assessments (DPIAs) where required by Article 35 of the GDPR;

4.6. Maintain a record of processing activities as required by Article 30 of the GDPR.

5. Sub-processor Obligations

Each sub-processor is contractually required to:

5.1. Process Personal Data only on documented instructions from the Controller;

5.2. Ensure that persons authorised to process Personal Data are bound by confidentiality obligations;

5.3. Implement appropriate technical and organisational security measures;

5.4. Assist the Controller with Data Subject rights requests;

5.5. Delete or return Personal Data upon termination of the service, unless retention is required by law;

5.6. Make available to the Controller all information necessary to demonstrate compliance with GDPR obligations;

5.7. Not engage further sub-processors without the Controller's prior authorisation.

3.7. Subprocessor incident transparency

In compliance with the transparency principle (GDPR Art. 5(1)(a)) and the Controller's accountability obligations (Art. 33):

• Vercel, Inc., April 2026 supply-chain incident: A vulnerability in the Context.ai third-party tool exposed limited customer credentials of Vercel users. Public bulletin: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident. The Controller assessed the impact on Sharpyield infrastructure and applied recommended mitigations (credential rotation, environment-variable review). If individual User data was confirmed affected, those Users were notified under Art. 34 GDPR.

The Controller maintains an internal breach_register.md tracking all subprocessor incidents (notifiable and non-notifiable) for accountability evidence under Art. 33(5) GDPR.

6. International Data Transfers

6.1. Where sub-processors are located outside the EEA (specifically: Stripe, Anthropic, Resend, and Sentry in the USA, and the few Vercel functions that run in the USA), transfers are protected by:

a) Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914);

b) Adequacy decisions, where available;

c) Supplementary measures as recommended by the EDPB, where necessary.

6.2. The Controller has assessed each transfer and determined that the combination of SCCs and supplementary measures provides an adequate level of protection.

6.3. Supabase (Ireland) and PostHog (Frankfurt) are configured to process data within the EU, avoiding international transfers for these services.

7. Security Measures

The Controller and its sub-processors implement the following categories of security measures:

• Encryption: TLS 1.2+ in transit; AES-256 at rest for database and file storage;
• Access control: Role-based access, principle of least privilege, multi-factor authentication for administrative access;
• Network security: Firewalls, DDoS protection (Vercel Edge), intrusion detection;
• Data minimisation: Only data strictly necessary for each processing purpose is shared with each sub-processor;
• Monitoring: Automated alerting for anomalous access patterns, error tracking, audit logging;
• Incident response: Documented procedure for identifying, containing, and reporting security incidents;
• Backup and recovery: Encrypted backups with defined retention periods and tested recovery procedures.

8. Data Breach Notification

8.1. In the event of a personal data breach, the Controller shall:

a) Notify the CNPD without undue delay and, where feasible, within 72 hours (Art. 33 GDPR);

b) Notify affected Data Subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR);

c) Document the breach, its effects, and the remedial actions taken.

8.2. Each sub-processor is contractually obligated to notify the Controller without undue delay upon becoming aware of a personal data breach.

9. Data Subject Rights

9.1. The Controller is responsible for responding to Data Subject rights requests (access, rectification, erasure, restriction, portability, objection).

9.2. Each sub-processor is contractually required to assist the Controller in fulfilling these requests, including by providing technical means to extract, correct, or delete data.

9.3. Requests should be directed to privacy@sharpyield.com.

10. Changes to Sub-processors

10.1. The Controller may add or replace sub-processors. Material changes will be reflected in updates to this DPA and communicated through updates to the Privacy Policy.

10.2. The current list of sub-processors is maintained in this document and in the Privacy Policy.

11. Term and Termination

11.1. This DPA remains in effect for as long as the Controller processes Personal Data in the context of the Sharpyield service.

11.2. Upon termination of the User's account, the Controller ensures that all sub-processors delete or return the User's Personal Data within the retention periods specified in the Privacy Policy.

12. Governing Law

This DPA is governed by Portuguese law. Disputes shall be resolved in accordance with the dispute resolution provisions of the Terms and Conditions.

13. Contact

For questions about this DPA or data processing practices:

• Privacy email: privacy@sharpyield.com
• General email: support@sharpyield.com
• Address: Sharpyield, Unipessoal Lda, Rua Major João Gomes, Lote 37, 1.º e 2.º, 2640-491 Mafra, Portugal