Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Atellier Master Subscription Agreement (or equivalent agreement) between Worldwide Signage Ltd. ("Atellier", "Processor") and {{customer_legal_name}} ("Customer", "Controller"), with effective date {{effective_date}}. It governs the Processing of Personal Data by Atellier on behalf of Customer in connection with the Service.

1. Parties

• Processor: Worldwide Signage Ltd. (d/b/a Atellier), 8405 W 54th Place, Arvada, Colorado 80002, United States. Contact: hello@meonneon.com
• Controller: {{customer_legal_name}}, {{customer_address}}. Contact: {{customer_contact_email}}

2. Definitions

Capitalised terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679), the UK GDPR, or the Master Agreement. "Personal Data", "Processing", "Controller", "Processor", "Sub-processor", "Data Subject", and "Personal Data Breach" are used as defined in GDPR Art. 4. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Decision 2021/914 (Modules 2 and 3 as applicable). "UK IDTA" means the International Data Transfer Addendum issued by the UK Information Commissioner.

3. Subject Matter, Duration, Nature and Purpose of Processing

• Subject matter: Processing of Personal Data necessary for Atellier to provide the Service.
• Duration: For the term of the Master Agreement, plus the deletion / return period set out in Section 13.
• Nature: Hosting, storage, retrieval, transmission, analysis, organisation, and deletion of Personal Data.
• Purpose: To deliver the contracted Service (CRM, proposals, communications, projects, finance, and related modules) for Customer.

4. Categories of Data Subjects and Personal Data

5. Controller Obligations

• Customer warrants that it has a valid lawful basis to Process the Personal Data and to instruct Atellier to do so.
• Customer is responsible for the accuracy, quality, and legality of Personal Data uploaded to the Service.
• Customer will provide all required notices and obtain all required consents from Data Subjects.
• Customer's documented instructions to Atellier are set out in this DPA, the Master Agreement, and the in-product configuration; further written instructions may be issued via hello@meonneon.com.

6. Processor Obligations (GDPR Art. 28(3))

• (a) Process Personal Data only on documented instructions from Customer, including with regard to international transfers, unless required by Union or Member State law.
• (b) Ensure persons authorised to Process the Personal Data are bound by confidentiality obligations.
• (c) Take all measures required by Art. 32 (security of processing) — see Annex II.
• (d) Engage Sub-processors only in accordance with Section 7.
• (e) Taking the nature of Processing into account, assist Customer with appropriate technical and organisational measures to fulfil Data Subject rights requests (Chapter III GDPR).
• (f) Assist Customer in ensuring compliance with Art. 32–36 (security, breach notification, DPIAs, prior consultation).
• (g) At Customer's choice, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless retention is required by law (see Section 13).
• (h) Make available to Customer all information necessary to demonstrate compliance with Art. 28, and allow for and contribute to audits (see Section 12).
• Atellier will inform Customer immediately if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

7. Sub-Processors

Customer provides general written authorisation for Atellier to engage the Sub-processors listed in Annex III below. Atellier will give at least 30 days' notice of the addition or replacement of any Sub-processor (by updating this page and notifying the Customer's account contact). Customer may object on reasonable data-protection grounds within that period; if no commercially reasonable alternative is available, Customer may terminate the affected portion of the Service.

Atellier imposes data-protection terms on each Sub-processor that are no less protective than those in this DPA, and remains fully liable for the Sub-processor's performance of those obligations.

8. International Data Transfers

Where Processing involves the transfer of Personal Data from the EEA, UK, or Switzerland to a country not deemed adequate, the parties agree:

• EU SCCs (Decision 2021/914), Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor) as applicable, are incorporated by reference and deemed executed. Atellier is the data importer; Customer is the data exporter. The optional docking clause applies. Clause 9(a) Option 2 (general authorisation, 30-day notice), Clause 17 Option 1 (Irish law), and Clause 18 (Irish courts) apply.
• UK IDTA is incorporated by reference for transfers subject to UK data protection law; Tables 1–4 are completed using the corresponding fields of this DPA and Annexes I–III.
• Swiss FADP: where transfers are subject to the Swiss FADP, the SCCs apply with references to the GDPR construed as references to the FADP, and "Switzerland" replaces references to EU Member States.

9. Security Measures (Annex II)

Atellier maintains the technical and organisational measures (TOMs) set out in Annex II below to ensure a level of security appropriate to the risk.

10. Personal Data Breach Notification

Atellier will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer's data. The notification will, to the extent then known, describe (a) the nature of the breach, (b) categories and approximate numbers of Data Subjects and records affected, (c) likely consequences, and (d) measures taken or proposed. Atellier will provide further information as it becomes available and reasonably cooperate with Customer's regulatory and Data Subject notifications.

Internal severity tiers and target initial-notification windows:

• P1 (Confirmed unauthorized access to Customer Data) — initial notice within 24 hours of confirmation; ongoing updates at least every 24 hours until resolution.
• P2 (Suspected breach under active investigation) — initial notice within 48 hours of becoming aware; ongoing updates as material facts emerge.
• P3 (Indicators of compromise without confirmed data exposure) — notice within 72 hours of becoming aware. All tiers respect the 72-hour outer limit required by GDPR Art. 33(2).

11. Data Subject Rights Assistance

The Service exposes self-service controls allowing Customer (as Controller) to satisfy access, rectification, erasure, restriction, portability, and objection requests directly. Where additional Atellier assistance is required, Customer may contact hello@meonneon.com; Atellier will respond within a commercially reasonable time and at no charge for routine requests.

12. Audits

Atellier will, upon request, make available to Customer (a) its most recent third-party security report or assessment and (b) responses to a reasonable security questionnaire. Where Customer reasonably believes such information is insufficient to demonstrate compliance, Customer may, no more than once per 12-month period and on at least 30 days' written notice, conduct an on-site or remote audit during business hours, subject to confidentiality and to not unreasonably disrupting Atellier's operations. The audit must be conducted by Customer or by an independent third-party auditor (not a competitor of Atellier) bound by written confidentiality. Costs of the audit are borne by Customer; Atellier may charge its reasonable time and expenses (capped at USD 5,000 per audit, or as separately agreed for enterprise customers) unless the audit identifies a material breach by Atellier, in which case Atellier bears the reasonable cost of the audit and the remediation.

12A. Sensitive Data Prohibition

Customer will not upload, store, or transmit through the Service any "special categories of personal data" within the meaning of GDPR Art. 9 (including health, biometric, racial or ethnic, political, religious, sexual orientation, or trade-union data), data concerning criminal convictions and offences (Art. 10), Protected Health Information under HIPAA, full payment-card numbers (PANs) outside designated Stripe-managed flows, government-issued identifiers, or data of children under 16 — without prior written agreement with Atellier. The Service is not designed or warranted for processing such categories.

12B. AI Sub-Processor Flow-Down

Where Atellier uses AI sub-processors (see Annex III) to deliver AI Features, Atellier imposes contractual terms requiring those providers (a) not to use Customer Data to train, fine-tune, or otherwise improve their foundation models, (b) to maintain security measures consistent with Annex II to the extent applicable to inference workloads, and (c) to delete inference data after processing or within their published retention window. The current list of AI sub-processors is published at /subprocessors and governed by the AI Features Addendum.

13. Term, Termination, and Return / Deletion of Data

This DPA remains in force for as long as Atellier Processes Personal Data on behalf of Customer. On termination of the Service, Customer may, at its election:

• Export data via the in-product export tools during a 30-day off-boarding window;
• Request return of Personal Data in a structured, commonly-used, machine-readable format by emailing hello@meonneon.com within the 30-day window;
• Default — if no election is made within 30 days, Atellier will delete Personal Data from active systems.

Following the elected option, Atellier will delete Customer's Personal Data from active systems within 30 days, with backup copies aging out within a further 30 days. Atellier may retain Personal Data only to the extent and for the duration required by applicable law.

14. Liability and Governing Law

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Master Agreement. This DPA is governed by the laws of the State of Colorado, USA, except where the SCCs or UK IDTA specify a different governing law for transfer-related claims.

Annex I — Description of Processing

• Data exporter: {{customer_legal_name}} (Controller) — contact: {{customer_contact_email}}
• Data importer: Worldwide Signage Ltd. (Processor) — hello@meonneon.com
• Categories of Data Subjects: as set out in Section 4.
• Categories of Personal Data: as set out in Section 4.
• Sensitive data: not intended; not to be uploaded without prior written agreement.
• Frequency of transfer: continuous, for the duration of the subscription.
• Nature and purpose: provision of the Service.
• Period of retention: as set out in Section 13 and the Atellier Privacy Policy.

Annex II — Technical and Organisational Measures

• Encryption in transit: TLS 1.2+ for all client and inter-service traffic.
• Encryption at rest: AES-256 for primary databases, file storage, and backups.
• Access control: row-level security (RLS) on all tenant data; least-privilege role model; production access restricted to a minimal on-call set.
• Authentication: mandatory unique credentials, password complexity, optional and (for admins) enforced MFA.
• Audit logs: administrative actions, login events, permission changes, and data exports are logged and retained for 12 months.
• Backups: automated daily backups; 30-day rolling retention; quarterly restore tests.
• Network security: WAF, DDoS protection (Cloudflare), and isolated production VPC.
• Vulnerability management: automated dependency scanning, periodic penetration testing, documented patch SLA.
• Personnel: confidentiality agreements for all staff; security training on hire and annually.
• Incident response: documented playbook with 72-hour breach notification commitment.
• Sub-processor governance: written DPAs with each sub-processor; annual posture review.
• Physical security: provided by underlying cloud providers (AWS, Cloudflare) under SOC 2 / ISO 27001 attestations.

Annex III — List of Sub-Processors

16. Signature

Use the "Download as PDF" button at the top of this page for an executable copy. Both parties' signature blocks are included on the final page.

Contact

Questions or to request a countersigned copy: hello@meonneon.com

Worldwide Signage Ltd. d/b/a Atellier
8405 W 54th Place
Arvada, Colorado 80002
United States