NeatSilo Data Processing Agreement

Effective date: 30 October 2026. Last updated: 2 November 2026

1. Parties and scope

This Data Processing Agreement ("DPA") is between Swiftlink L.L.C-FZ, a company registered in the Meydan Free Zone, Dubai, United Arab Emirates, under licence number 2654602.01, with its registered office at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("NeatSilo", the "Processor"), and the business that has accepted the NeatSilo Terms of Service (the "Customer", the "Controller").

This DPA forms part of the Terms of Service and applies automatically when the Customer accepts them. It covers personal data that NeatSilo processes on the Customer's behalf when providing the Service. If this DPA and the Terms conflict on data protection, this DPA wins.

2. Definitions

• Data Protection Laws: all laws on personal data that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the UAE Personal Data Protection Law, where applicable.
• Customer Personal Data: personal data in content the Customer or its users put into the Service, as described in Annex 1.
• Sub-processor: a third party NeatSilo engages to process Customer Personal Data.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Terms such as "controller", "processor", "processing" and "data subject" have the meanings given in the Data Protection Laws.

3. Roles

• The Customer is the controller of Customer Personal Data, and NeatSilo is its processor.
• The Customer is responsible for having a lawful basis for the processing, and for informing its staff and other data subjects, including that NeatSilo records who performed each stock action and when.
• For account, billing, support and website data, NeatSilo acts as an independent controller under its Privacy Policy. Paddle.com acts as an independent controller of payment data as Merchant of Record.

4. NeatSilo's obligations

Instructions. NeatSilo processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service are those instructions. NeatSilo will tell the Customer if it believes an instruction breaks Data Protection Laws, or if the law requires processing beyond the instructions (unless the law forbids telling).

Confidentiality. Everyone NeatSilo authorises to process Customer Personal Data is bound by confidentiality.

Security. NeatSilo applies appropriate technical and organisational measures to protect Customer Personal Data, including those in Annex 2, and reviews them as the Service develops.

Sub-processors. The Customer gives general authorisation for NeatSilo to use Sub-processors. The current list is in Annex 3. NeatSilo will give at least 30 days' notice of a new Sub-processor by email to the Customer's admins or in the Service. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may end the affected subscription and receive a refund of prepaid fees for the unused period. NeatSilo imposes data protection terms on each Sub-processor that are no less protective than this DPA, and remains responsible for them.

Assistance. Taking into account the nature of the processing, NeatSilo will help the Customer:

• respond to requests from data subjects exercising their rights. If a data subject contacts NeatSilo directly about Customer Personal Data, NeatSilo will pass the request to the Customer and not respond itself, except to say it has done so;
• meet its obligations on security, breach notification, data protection impact assessments and consultation with regulators, using the information available to NeatSilo.

Personal Data Breaches. NeatSilo will notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects affected, the likely consequences and the measures taken or proposed, as far as this is known, with updates as more becomes available. Notifying the Customer is not an admission of fault.

5. International transfers

Customer Personal Data is stored mainly in the EU (Ireland) and may be accessed from the United Arab Emirates and processed by Sub-processors in other countries, as listed in Annex 3. Where Data Protection Laws restrict a transfer, the parties agree that the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where NeatSilo passes data to Sub-processors) apply and are incorporated by reference, together with the UK International Data Transfer Addendum for UK data. For those clauses: the optional docking clause applies; option 2 (general written authorisation) applies to Sub-processors with the notice period in section 4; the governing law and courts are those of Ireland; and Annexes 1 to 3 of this DPA complete their annexes.

6. Return and deletion

The Customer can export its data from the Service while its account is active or read-only. After the account is closed, NeatSilo deletes Customer Personal Data within 90 days, and from backups when they expire (within 7 days of that), unless the law requires NeatSilo to keep it.

7. Audits

NeatSilo will make available the information reasonably needed to show compliance with this DPA, including answering security questionnaires. If that is not enough, the Customer may request an audit once a year, with at least 30 days' notice, during business hours, at its own cost, by itself or an independent auditor bound by confidentiality, in a way that does not disrupt the Service or expose other customers' data. Audits by a regulator are not limited in this way.

8. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service, except where Data Protection Laws do not allow them.

9. Term, changes and law

• This DPA lasts as long as NeatSilo processes Customer Personal Data for the Customer.
• NeatSilo may update this DPA to reflect changes in law or in the Service, with notice as for the Terms. Changes will not reduce the protection of Customer Personal Data.
• Apart from the transfer clauses in section 5, this DPA is governed by the same law and courts as the Terms of Service.
• A signed copy is available on request at support@neatsilo.com.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit (HTTPS/TLS) and at rest.
• Passwords stored only as secure hashes; email verification; secure password change requiring the current password.
• Each organisation's data separated by access rules enforced in the database (row-level security), not just in the app.
• Admin-only actions checked on the server; stock history append-only, with mistakes reversed rather than edited.
• Least-privilege access for NeatSilo staff, with two-factor authentication on administrative accounts.
• Production secrets stored only in the hosting provider's encrypted environment settings; separate development and production systems.
• Daily backups kept for 7 days.
• Monitoring of payment and system events; dependency updates for security advisories.

Annex 3: Sub-processors

Paddle.com (payments, as Merchant of Record) and Apple and Google (app distribution) act as independent controllers, not Sub-processors.