DATA PROCESSING AGREEMENT (ISV)

Version 1.0, published at https://adure.io/dpa-isv.

This Data Processing Agreement ("DPA") is entered into between Adure BV, with its registered office at Kleitstraat 24A, 9930 Lievegem, Belgium, registered with the Crossroads Bank for Enterprises under number BE1030 018 353 (the "Processor"), and the Customer identified in the applicable Order Form (the "Controller") (each a "Party" and together the "Parties").

This DPA is incorporated into the Agreement by reference and applies without separate signature. The Order Form identifies the Parties and records their agreement to this DPA.

WHEREAS

(A) The App is a Salesforce-native integration that runs within the Controller's own Salesforce org and, where applicable, connects to the Controller's own account(s) with the third-party platform(s) identified in the applicable Product Schedule and Data Annex (together with the Salesforce Platform, the "Customer Platforms"), each of which the Controller licenses and contracts for directly with the relevant platform provider. The Controller's own business data and the personal data of the Controller's own customers, counterparties, and other end users ("End-User Data") are created, processed and stored solely within the Customer Platforms. The Processor does not host, store, transmit for its own retention, or otherwise process End-User Data, and has no access to, control over, or visibility into the Customer Platforms beyond what the integration requires to function.

(B) The Parties have entered into the Adure BV Master Subscription Agreement (the "Agreement"), under which the Processor provides the Controller with access to the Services (as defined in the Agreement).

(C) In the course of performing the Agreement, the Processor processes limited Personal Data of the Controller's own designated administrators, Users, and billing contacts for account administration, support, and invoicing purposes ("Account Data", as further described in Annex 1). The applicable data protection legislation requires the Parties to enter into a data processing agreement governing that limited processing.

(D) The Processor has represented that it has the necessary competence, capacity and resources to carry out this processing in compliance with applicable data protection legislation.

(E) This DPA is a separate document from, but forms an integral part of and is incorporated by reference into, the Agreement. It applies for as long as the Processor processes Account Data on the Controller's behalf under the Agreement. Terms not defined in this DPA have the meaning given in the Agreement.

THE PARTIES HAVE AGREED AS FOLLOWS:

1. DEFINITIONS

"Account Data" means the limited Personal Data the Processor processes on the Controller's behalf under this DPA --- namely, the name, business contact details, and role of the Controller's designated administrators, Users, and billing or finance contacts --- processed solely for account administration, support, and invoicing purposes. Account Data excludes End-User Data.

"Agreement" means the Adure BV Master Subscription Agreement referred to in Recital (B), published at https://adure.io/master-subscription-agreement, including its Order Forms and Schedules.

"Data Subject(s)" means the identified or identifiable natural person(s) to whom Personal Data relates.

"EEA" means the European Economic Area.

"End-User Data" means the Controller's own business data and the Personal Data of the Controller's own customers, counterparties, and other end users processed through the Customer Platforms in connection with the Controller's use of the App. End-User Data is processed and stored solely within the Customer Platforms, is not Personal Data the Processor processes, and is outside the scope of this DPA.

"Customer Platforms" means the Salesforce Platform and any other third-party platform(s) identified in the applicable Product Schedule and Data Annex, in each case licensed and contracted for by the Controller directly with the relevant platform provider, within which End-User Data resides.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation), as may be amended, supplemented or replaced from time to time, together with any applicable Belgian implementing legislation.

"Personal Data" means Account Data, being the only Personal Data the Processor processes on behalf of the Controller under the Agreement.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Special Categories of Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, data concerning health, or data concerning a natural person's sex life or sexual orientation, as referred to in Article 9 GDPR, and Personal Data relating to criminal convictions and offences referred to in Article 10 GDPR.

"Sub-processor" means any third party engaged by the Processor to process Account Data on behalf of the Controller in connection with the Services. The providers of the Customer Platforms (for example, Salesforce and any integrated third-party platform) are not Sub-processors of the Processor --- see Article 4.

"Supervisory Authority" means an independent public authority with responsibility for monitoring the application of the GDPR, including the Belgian Data Protection Authority.

2. SUBJECT MATTER AND SCOPE

2.1 This DPA governs only the Processor's processing of Account Data. Save as provided in Article 2.7, the Processor does not process End-User Data, does not act as a processor or sub-processor with respect to End-User Data, and has no obligations under this DPA, Article 28 GDPR, or otherwise with respect to Personal Data processed within the Customer Platforms.

2.2 The Processor shall process Account Data solely in the name and on behalf of the Controller, solely for the purposes of account administration, support, and invoicing, and solely in accordance with the Controller's documented instructions, unless required to do otherwise by Union or Belgian law, in which case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

2.3 The Controller warrants that it has a valid legal basis under Articles 6 and, where applicable, 9 and 10 GDPR for disclosing Account Data to the Processor, and shall indemnify the Processor against losses, expenses and liabilities arising directly from the Controller's breach of this warranty.

2.4 The subject matter, duration, nature and purpose of the processing, the type of Account Data, and the categories of Data Subjects are set out in Annex 1. The Parties shall update Annex 1 by mutual written agreement if any of these elements change. The Processor shall promptly inform the Controller in writing if it becomes aware that any element of Annex 1 requires updating.

2.5 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR and as further described in Annex 2, and shall not use, edit, copy or otherwise process Account Data beyond what is strictly necessary to perform the Agreement.

2.6 Annex 3 (Special Categories of Personal Data) does not apply, as the Processor does not process Special Categories of Personal Data in connection with Account Data.

2.7 Incidental End-User Data in support. The Controller shall not include End-User Data in support requests, logs, screenshots, error reports, exports or other material it sends to the Processor, and shall redact or pseudonymise such data before sending it. Where End-User Data nonetheless reaches the Processor incidentally in the course of providing support, the Processor shall (i) process it only to the extent necessary to resolve the support request and otherwise on the Controller's documented instructions, (ii) apply to it the confidentiality obligations in Article 3 and the technical and organisational measures in Article 7 and Annex 2, (iii) not transfer it outside the EEA other than in accordance with Article 8, (iv) not retain it beyond resolution of the support request, deleting it or returning it at the Controller's choice, and (v) notify the Controller in accordance with Article 6 if it becomes aware of a Personal Data Breach affecting it. Incidental receipt under this Article does not make the Processor a processor of End-User Data held within the Customer Platforms, which remains outside the scope of this DPA.

3. CONFIDENTIALITY

3.1 The Processor shall treat all Account Data, and the existence and content of the processing carried out on the Controller's behalf, as strictly confidential.

3.2 The Processor shall ensure that persons authorised to process Account Data (including employees, contractors and Sub-processors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and shall grant access only on a need-to-know basis.

3.3 This duty of confidentiality survives termination of this DPA for a period of five (5) years, save that it shall continue indefinitely with respect to any Account Data that has not been deleted or returned in accordance with Article 11.

4. SALESFORCE AND CONTROLLER RESPONSIBILITIES

4.1 The Controller licenses and contracts for the Salesforce Platform and any integrated third-party platform directly with the relevant platform providers. The providers of the Customer Platforms are not engaged, appointed, or authorised by the Processor, are not Sub-processors of the Processor, and do not process Account Data or any other Personal Data on the Processor's behalf. The Controller is solely responsible for: (i) entering into and maintaining its own agreements, data processing addenda, and Standard Contractual Clauses (as applicable) directly with the relevant platform providers; (ii) selecting and configuring the appropriate Customer Platform data centres, regions, and settings needed to meet the Controller's own data residency, international transfer, and other regulatory requirements for End-User Data; and (iii) its own and its Users' compliance with applicable data protection law in its use of the Customer Platforms, independently of this DPA and the Agreement.

4.2 The Processor has no access to, control over, or visibility into End-User Data processed or stored within the Customer Platforms, and accordingly has no ability to assist with, and no liability for, Data Subject requests, security incidents, audits, or regulatory obligations relating to End-User Data. Such matters are governed exclusively by the Controller's own agreements with the relevant platform providers.

4.3 The Controller grants the Processor a general written authorisation to engage Sub-processors to process Account Data, provided the Processor maintains an up-to-date list of such Sub-processors and notifies the Controller of any intended addition or replacement, giving the Controller a reasonable opportunity (of no less than fourteen (14) days) to object on reasonable data-protection grounds. The current Sub-processors, if any, are listed in Annex 3a.

4.4 Where the Processor engages a Sub-processor to process Account Data, it shall impose on that Sub-processor, by way of a contract, data protection obligations no less protective of Account Data than those set out in this DPA, and remains fully liable to the Controller for the Sub-processor's performance of those obligations.

4.5 The Processor shall, at the Controller's request, provide a copy of the relevant provisions of its agreement with a Sub-processor of Account Data (redacted of commercially sensitive terms not relevant to data protection).

4.6 If the Controller objects to a new Sub-processor of Account Data under Article 4.3, the Parties shall discuss in good faith a reasonable alternative that avoids the objected-to Sub-processor processing Account Data. If the Processor is unable to offer such an alternative within thirty (30) days of the objection, the Controller may terminate the Agreement solely with respect to the Services that cannot be provided without that Sub-processor, by written notice to the Processor, and the Processor shall refund any prepaid Subscription Fees covering the remainder of the term for the terminated Services, without penalty to the Controller.

5. ASSISTANCE TO THE CONTROLLER

5.1 The Processor shall, taking into account the nature of the processing and the information available to it, assist the Controller by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling the Controller's obligations to respond to Data Subject requests under Chapter III GDPR relating to Account Data. The Processor shall forward any such Data Subject request it receives to the Controller without undue delay, and shall not itself respond to such a request unless authorised to do so by the Controller. For the avoidance of doubt, and consistent with Article 4, the Processor has no ability to assist with Data Subject requests relating to End-User Data, which must be directed to the Customer Platforms.

5.2 The Processor shall assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation) with respect to Account Data, taking into account the nature of the processing and the information available to the Processor.

5.3 Where the Processor's assistance under this Article 5 requires materially more than reasonable effort integrated into the standard Services, the Processor may charge reasonable compensation for such assistance, to be agreed with the Controller in advance.

5.4 Documentation. Upon the Controller's reasonable request, no more than once per calendar year, the Processor shall make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR with respect to Account Data, which may take the form of a written summary of the Processor's security measures, relevant third-party certifications or audit reports the Processor then holds (if any), and responses to a reasonable, standard information-security questionnaire.

5.5 On-site audit. If the documentation provided under Article 5.4 is not sufficient to address a specific, reasonable concern, or following an actual Personal Data Breach affecting Account Data, or where an on-site audit is required by the Controller's Supervisory Authority, the Controller (or an independent auditor mandated by it, provided such auditor is not a direct competitor of the Processor and is bound by confidentiality obligations no less protective than those in Article 3) may conduct an on-site audit of the Processor's premises and records relevant to the processing of Account Data. Such audits (i) require at least thirty (30) days' prior written notice, except where prompted by an actual Personal Data Breach; (ii) shall be conducted no more than once per calendar year, except following an actual Personal Data Breach; (iii) shall be carried out during normal business hours and in a manner that minimises disruption to the Processor's business; and (iv) shall be at the Controller's expense, including reasonable compensation for the Processor's time at its then-current professional services rates, to be communicated to the Controller in advance, save that no charge applies where the audit follows an actual Personal Data Breach affecting Account Data, where the audit is required by the Controller's Supervisory Authority, or where the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear its own costs and reimburse the Controller's reasonable audit costs. No charge under this Article operates as a condition of the Controller's exercise of its audit rights under Article 28(3)(h) GDPR. The Parties shall agree the scope, timing and duration of any on-site audit before it begins. For the avoidance of doubt, this Article 5.5 does not extend to an audit of the Customer Platforms, which the Processor does not control.

6. PERSONAL DATA BREACH

6.1 The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Account Data. This Article 6 does not apply to a security incident occurring solely within the Customer Platforms, which the Controller is responsible for detecting and addressing under its own agreements with the relevant platform providers.

6.2 The notification shall describe, to the extent the information is available to the Processor: (i) the nature of the breach, including where possible the categories and approximate number of Data Subjects and Account Data records concerned; (ii) the name and contact details of a contact point for further information; (iii) the likely consequences of the breach; and (iv) the measures taken or proposed to address the breach and mitigate its effects. Where not all information is available at the time of notification, the Processor shall provide it in phases without undue further delay.

6.3 The Processor shall provide reasonable assistance to the Controller in connection with any notification of the breach to a Supervisory Authority or affected Data Subjects, and shall respond to the Controller's related requests on a priority basis.

7. SECURITY MEASURES

7.1 The Processor shall implement and maintain the technical and organisational security measures described in Annex 2 to protect Account Data, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of the processing, and the risk to the rights and freedoms of Data Subjects.

7.2 The Processor shall review and update these measures periodically and following any relevant security incident. Where the Controller has not provided the Processor with sufficient information about the processing to assess additional risk-specific measures, the Processor's obligation is limited to the measures described in Annex 2.

8. INTERNATIONAL TRANSFERS

8.1 Account Data is processed within the EEA, as set out in Annex 1, using the Processor's own infrastructure and Sub-processors (if any). This Article 8 does not apply to End-User Data, which is processed and stored solely within the Customer Platforms; the Controller is solely responsible, as set out in Article 4.1, for selecting Customer Platform data centres and regions that meet its own data residency and international transfer requirements for End-User Data.

8.2 The Processor shall not transfer Account Data outside the EEA unless (i) the transfer is to a country benefiting from an adequacy decision of the European Commission, (ii) the transfer is subject to appropriate safeguards under Article 46 GDPR, such as the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, as updated from time to time, attached as Annex 5) or, where applicable, the UK International Data Transfer Addendum, or (iii) another valid transfer mechanism under Chapter V GDPR applies. Where the Processor relies on Standard Contractual Clauses with a Sub-processor, it shall ensure the Sub-processor enters into an equivalent onward-transfer mechanism, and remains liable to the Controller for the Sub-processor's compliance.

8.3 A transfer required by mandatory Union or Belgian law shall be permitted without additional consent, provided the Processor notifies the Controller in advance in writing of the legal basis for the transfer, unless such notification is prohibited on important grounds of public interest.

8.4 To the extent Annex 5 (the Standard Contractual Clauses) applies to a transfer of Account Data under this DPA, Annex 1 to this DPA serves as Annex I (List of Parties and Description of the Transfer) and Annex 2 to this DPA serves as Annex II (Technical and Organisational Measures) to those Clauses, and Annex 3a serves as the list of sub-processors authorised under Clause 9 (Use of Sub-processors) of those Clauses. In the event of any conflict between the body of this DPA and Annex 5, Annex 5 shall prevail with respect to the transfer it governs.

9. GOVERNMENT AND THIRD-PARTY DATA REQUESTS

9.1 This Article 9 applies only to Account Data; requests concerning End-User Data must be directed to the Controller or to the relevant platform provider directly, as applicable. The Processor shall not disclose Account Data to any law enforcement or government authority except where legally compelled to do so. If the Processor receives a legally binding request from such an authority for disclosure of Account Data, the Processor shall, unless legally prohibited from doing so, (i) promptly notify the Controller before disclosure and provide a copy of the request, (ii) attempt to redirect the authority to request the Account Data directly from the Controller, and (iii) if disclosure cannot be avoided, disclose only the minimum amount of Account Data necessary to comply with the request.

9.2 The Processor shall not provide any third party (i) direct, indirect, blanket or unfettered access to Account Data, (ii) encryption keys used to secure Account Data or any means to circumvent the Processor's encryption, or (iii) access to Account Data where the Processor is aware that the data will be used for a purpose other than that stated in the request.

9.3 The Processor shall document requests for access to Account Data received from public authorities, and the Processor's response, and shall make that documentation available to the Controller upon request to the extent legally permitted.

10. LIABILITY

10.1 Each Party is liable for damages caused by its own non-compliance with this DPA or with applicable data protection law, in accordance with Article 82 GDPR.

10.2 The Processor shall indemnify the Controller for damages, fines, administrative sanctions and reasonable legal costs arising from a third-party claim, a Supervisory Authority action, or a Data Subject claim, to the extent directly caused by the Processor's breach of this DPA or of its obligations as processor under the GDPR with respect to Account Data, including damages caused by a Sub-processor of Account Data engaged by the Processor. For the avoidance of doubt, the Processor has no liability under this DPA for End-User Data, which is governed exclusively by the Controller's own agreements with the relevant platform providers.

10.3 The Processor's total liability under this DPA, whether arising in one or more incidents, is subject to the same aggregate liability cap set out in Section 10 (Limitation of Liability) of the Agreement --- namely, the total Subscription Fees paid by the Controller in the twelve (12) months preceding the event giving rise to the liability. For the avoidance of doubt, this cap is a single aggregate cap shared with, and not in addition to, the cap in Section 10 of the Agreement.

10.4 The Processor shall maintain insurance covering the risks described in this Article 10, consistent with the insurance obligations set out in the Agreement.

10.5 Nothing in this Article 10 limits either Party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded under applicable law.

11. DURATION AND TERMINATION

11.1 This DPA takes effect on the Effective Date of the Agreement, without separate signature, and remains in force for as long as the Processor processes Account Data on the Controller's behalf under the Agreement. This DPA terminates automatically, without separate notice, upon termination or expiry of the Agreement.

11.2 Either Party may terminate this DPA immediately, without prejudice to its other rights and remedies, if the other Party is in material breach of this DPA and fails to remedy that breach within thirty (30) days of receiving written notice describing the breach.

11.3 Upon termination of this DPA, the Processor shall, at the Controller's choice, delete or return all Account Data (including copies) in a structured, commonly used and machine-readable format, and shall delete existing copies within thirty (30) days thereafter, unless applicable Union or Belgian law requires continued storage of some or all of the Account Data, in which case the Processor shall isolate and protect that data from further processing and delete it once the legal retention requirement lapses. This Article 11.3 does not apply to End-User Data, which the Controller manages directly within the Customer Platforms.

12. GOVERNING LAW AND JURISDICTION

This DPA is governed exclusively by Belgian law. Disputes arising from this DPA shall be settled exclusively by the courts of the district of the Processor's registered seat, consistent with Section 13 (Notices, Governing Law and Jurisdiction) of the Agreement.

13. MISCELLANEOUS

13.1 If any provision of this DPA is held invalid, void or unenforceable, the remaining provisions remain in full force, and the Parties shall negotiate in good faith a replacement provision that most closely matches the purpose of the invalid provision.

13.2 Amendment. The Processor may publish an updated version of this DPA at the address stated at the head of this DPA only where the update (i) is required by applicable law, by a Supervisory Authority, or by a change to the Standard Contractual Clauses, or (ii) does not materially reduce the protections afforded to the Controller or to Data Subjects. The Processor shall give the Controller at least thirty (30) days' written notice of such an update, and the updated version takes effect on the date stated in the notice. If an update materially affects the Controller, the Controller may terminate the Agreement, without cost or penalty, by written notice given before the update takes effect. Any other amendment to this DPA is valid only if agreed in writing by both Parties. In addition, the Parties may update Annexes 1, 2 and 3a by mutual written agreement (including by email) without amending the body of this DPA.

13.3 In the event of any conflict between this DPA and the Agreement regarding the processing of Account Data, this DPA prevails; in all other respects, the Agreement governs the relationship between the Parties.

13.4 If the Account Data processed under this DPA, or the Parties' relationship, becomes subject to new data protection legislation or binding case law that materially affects this DPA, the Parties shall negotiate in good faith to bring this DPA into line with that legislation or case law.

13.5 If the Processor holds a relevant certification or adheres to an approved code of conduct regarding the processing of Account Data, it shall maintain that certification or adherence for the duration of this DPA.

13.6 Compliance by each Party with its obligations under this DPA is free of charge, save for the reasonable compensation expressly provided for in Articles 5.3, 5.5 and elsewhere in this DPA.

Annex 1 -- Details of the Processing (Account Data only)

The subject matter, duration, nature and purpose of the processing, the types of Account Data, the categories of Data Subjects, and the location(s) of processing are set out in the Data Annex for the applicable App, which forms part of this DPA. Where the Standard Contractual Clauses in Annex 5 apply, this Annex 1 (as completed by the applicable Data Annex) serves as Annex I to those Clauses.

Annex 2 -- Technical and Organisational Security Measures

The Processor implements the following measures to protect Account Data, in accordance with Article 32 GDPR. These measures apply to the Processor's own systems only --- the Customer Platforms are secured under the Controller's own arrangements with the relevant platform providers.

Organisational measures

• Designated security responsibility within the organisation >• Documented information security policy, reviewed at least annually >• Staff confidentiality undertakings and periodic security-awareness training >• Incident response and breach-notification procedure >• Data classification and access-control policy >• Business continuity and disaster-recovery plan >• Periodic testing and evaluation of the effectiveness of these measures

Technical measures

• Encryption of Account Data in transit (TLS) and, where applicable, at rest >• Role-based access control and the principle of least privilege >• Multi-factor authentication for administrative access >• Logging and monitoring of access to systems processing Account Data >• Regular patching and vulnerability management >• Firewall and network segmentation >• Regular backups with tested restoration procedures

Annex 3 -- Special Categories of Personal Data

Not used. As stated in Article 2.6, the Processor does not process Special Categories of Personal Data under this DPA. Should the Parties agree in writing that it does, they shall complete this Annex with the access-control, impact-assessment and additional security safeguards applicable to that processing, and amend Article 2.6 accordingly.

Annex 3a -- Current Sub-processors

The Customer Platforms are licensed and contracted for by the Controller directly and are not Sub-processors of the Processor --- see Article 4.

The Processor's Sub-processors fall into two categories:

(a) The Processor's own corporate Sub-processors --- those it engages to process Account Data within its own account, billing, support and contracting systems --- are set out in the Adure BV Sub-processors list, published at https://adure.io/sub-processors. That list applies to every Adure application, is maintained centrally, and forms part of this DPA.

(b) App-specific Sub-processors --- any third party engaged to process data specifically for a particular App --- are listed in the Data Annex for that App. For an App provided under this DPA (ISV), there are ordinarily none, because the Processor processes only Account Data.

Where the Standard Contractual Clauses in Annex 5 apply, the Adure BV Sub-processors list together with any App-specific Sub-processors named in the Data Annex serves as Annex III to those Clauses. Additions and replacements in either category are subject to the notice and objection mechanism in Article 4.3.

Annex 4 -- Data Protection Impact Assessment Information

Where a data protection impact assessment is required, the Processor shall assist the Controller, upon request and insofar as reasonably possible given its role as processor, by providing:

• A systematic description of the envisaged processing operations carried out by the Processor >• Information relevant to assessing the necessity and proportionality of those processing operations >• Information relevant to assessing risks to Data Subjects' rights and freedoms arising from the Processor's processing >• A description of the measures the Processor has implemented to address those risks, including the safeguards and security measures described in Annex 2

Annex 5 -- EU Standard Contractual Clauses

The standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses") are incorporated into this DPA by reference in their official, unmodified form, and apply automatically, without further action by the Parties, to any transfer of Account Data under this DPA that requires a transfer mechanism under Chapter V GDPR. The official text prevails over any summary or description of the Clauses. As set out in Article 8.1, the Clauses do not apply to End-User Data, which is outside the scope of this DPA.

The Parties adopt the Clauses as follows:

Where the Clauses apply, they prevail over the body of this DPA with respect to the transfer they govern, as set out in Article 8.4. The competent Supervisory Authority for the purposes of Clause 13 is the Supervisory Authority identified in Annex I, being by default the Belgian Data Protection Authority where the Controller is established in Belgium.

Version history