Runewrd Labs Data Processing Agreement

1 Parties, scope and priority

Runeward Labs means the service provider identified in the applicable order. Customer means the customer identified in that order. The order must identify each contracting legal entity and its address. Contract acceptance and operational contacts are governed by Schedule E. This Processing Agreement forms part of their service agreement, including the applicable order and Terms of Service, together the Agreement.

This Processing Agreement applies to Customer Personal Data processed by Runeward Labs or its engaged providers for hosted runeguard Cloud, the Console and instructed support. Hosted processing remains covered when data resides only on OVHcloud infrastructure and no Runeward Labs staff member reads it. For local-only or customer-operated self-hosting, data processed exclusively under the customer's control, without processing by Runeward Labs or a provider on its behalf, is outside this Processing Agreement; supplying software alone does not bring that data within scope. Data sent or made available to Runeward Labs for instructed support remains covered. The customer's own obligations continue to apply.

For personal-data protection, mandatory law and any validly applicable standard contractual clauses take priority, followed by this Processing Agreement and then the remainder of the Agreement. An order may add protection but cannot remove mandatory rights or contradict an applicable transfer instrument. The Agreement's commercial terms on indemnity, insurance where specified, force majeure and disputes apply only to the extent consistent with those priorities. A force majeure event does not excuse statutory protection, notification or cooperation duties.

2 Definitions and applicable law

Customer Personal Data means personal data within information Runeward Labs processes on the customer's behalf, including endpoint and directory records, findings, session excerpts when authorised, and substantive support materials. It does not include data Runeward Labs lawfully processes as a separate controller for its own narrowly defined relationship administration, as explained in the Privacy Policy. The purpose and actual use determine the role.

Data Protection Law means privacy, data protection, security and breach-notification law applicable to the relevant party and processing, including the GDPR, the NDPA and binding NDPC instruments identified under Legal authorities, and applicable US federal and state laws. It includes the UK GDPR and Data Protection Act 2018 where UK processing is in scope. References do not assert that every listed law applies to every customer. Controller, processor, personal data, processing and personal data breach have their GDPR meanings or the corresponding meanings under the applicable law. Subprocessor means another processor Runeward Labs engages to process Customer Personal Data.

3 Roles and documented instructions

The customer acts as controller, or as a processor authorised by its controller; Runeward Labs acts as processor or subprocessor respectively. The customer must obtain authority for its instructions and any further subprocessing. OVHcloud acts as a subprocessor where Runeward Labs engages it to process Customer Personal Data. Customer-engaged hosting is not Runeward Labs subprocessing solely because it runs runeguard. Runeward Labs' separate controller activities remain governed by the Privacy Policy. Nothing permits Runeward Labs to determine an unrelated purpose for Customer Personal Data.

Documented instructions consist of this Processing Agreement and its schedules, the applicable order, authorised configuration and administrator actions within the agreed service, and other written instructions the parties accept. They identify the processing purposes and limits, including international transfers. A feature update or general website statement does not authorise materially expanded collection by itself. The customer can withdraw or change an instruction through supported controls or written notice; the parties will address any resulting inability to provide the affected service.

Runeward Labs processes Customer Personal Data only on those instructions unless legally required otherwise within the limits of applicable data protection law. For processing governed by GDPR Article 28(3)(a), the exception is limited to Union or Member State law to which the processor is subject. A third-country demand does not by itself authorise conflicting processing or a transfer under GDPR Article 48 and Chapter V; the parties apply clause 12 and address any conflict before disclosure where legally possible. Where law permits, it informs the customer of that requirement before processing and provides enough information for the customer to assess it. If Runeward Labs believes an instruction infringes applicable data protection law, it informs the customer promptly, suspends the affected unlawful processing and cooperates on a lawful alternative. It is not required to follow an unlawful instruction.

Runeward Labs will not sell Customer Personal Data, share it for cross-context behavioural advertising, create advertising profiles from it, or use it to train, fine-tune or improve models for its own or third-party purposes. Any permitted security analysis is limited to providing and securing the instructed service. Runeward Labs will not convert customer telemetry into an independent identifiable research or product-training dataset through a general service-improvement clause.

4 Customer deployment responsibilities

The customer determines and documents a lawful basis, informs affected individuals, and obtains any legally required consultation, consent or authorisation before deployment. This includes employee and contractor monitoring, personal devices, communications, third-party content and applicable works council or employee representative processes. Administrator approval, licence acceptance and employee consent are different legal concepts.

The customer must configure the least intrusive measures appropriate to its security purpose; separate security investigation from productivity or employment scoring; restrict administrator privileges; review identity mappings and findings; and provide human review where required before actions with legal or similarly significant effects. It must not use the service for unlawful covert surveillance or an automated adverse employment decision merely because a security event is flagged.

Separate opt-ins and incident escalations are available only within the scope described in Schedule A. Before enabling content or other heightened-risk collection, the customer must complete any required legitimate-interest, communications-law and impact assessments and appropriate notices. A redaction feature does not remove the possibility of special-category, health, financial, legally privileged or other sensitive information. Deliberate processing of regulated or sensitive content requires the necessary legal conditions and any separately required agreement, such as a business associate agreement. The customer must minimise unnecessary content and promptly notify Runeward Labs of material changes to the agreed processing risk.

These responsibilities do not release Runeward Labs from its own legal obligations, the duty to provide sufficient guarantees, or the commitments in this Processing Agreement.

5 Confidentiality and authorised access

Runeward Labs restricts access to personnel who need it for an authorised purpose, are bound by enforceable confidentiality duties, and receive appropriate privacy and security instruction. It maintains an authorisation and offboarding process. Customer administrator access is governed by the customer; Runeward Labs' operator and support access is separately restricted and recorded. A support grant does not itself authorise onward disclosure to an unlisted provider.

Runeward Labs must protect Customer Personal Data when providing support, including attachments and internal notes. It will not place such material into an external AI service or unapproved collaboration tool contrary to the customer instructions, the authorised recipient arrangements under clause 7 or the transfer safeguards.

6 Security and continuity

Runeward Labs implements the measures in Schedule B and maintains security appropriate to the nature, scope, context, purposes and risks of the processing. It assesses confidentiality, integrity, availability and resilience, including the ability to restore access and regularly evaluate control effectiveness. The customer secures the infrastructure, devices, credentials and exports it controls, without reducing Runeward Labs' responsibility for its own service and software commitments.

Runeward Labs may improve or replace a measure if the overall protection is not materially reduced. It must notify the customer of a material reduction or a change that affects the agreed processing or transfer safeguards and resolve it before making the change where practicable and required. Changes cannot be used to avoid an agreed customer instruction. Runeward Labs does not represent that a certification, test or insurance policy exists unless expressly identified with its current scope in the Agreement or Schedule B.

7 Subprocessors and other recipients

The customer grants general written authorisation for subprocessors subject to the prior-disclosure and authorisation requirements in Schedule C. No provider is authorised solely because it belongs to a service category. Runeward Labs gives at least 30 days' advance written notice of an intended addition or replacement, including the provider's legal identity, purpose, categories of data, processing and access countries, and proposed safeguards. The customer may object on reasonable data protection grounds during that notice period. The provider must not receive affected data while an unresolved timely objection prevents authorisation.

The parties will seek an alternative, such as another provider or a configuration avoiding the affected processing. If they cannot resolve the objection, the customer may end the affected service without penalty and receive a proportionate refund of prepaid unused fees. A shorter notice period requires the customer's written agreement and does not waive any mandatory approval requirement.

Runeward Labs imposes written protection obligations on each subprocessor that are no less protective for the relevant processing, including instructions, confidentiality, security, rights assistance, incident reporting, deletion and lawful onward transfers. It remains responsible to the customer for its subprocessors' performance. It will provide necessary evidence of the arrangements, with proportionate redactions for unrelated confidential information.

Customer-selected identity, SIEM, webhook, ticketing or notification destinations are separately recorded as customer instructions and may be the customer's own recipients. If Runeward Labs itself engages a provider to process the data, describing it as an integration does not avoid the subprocessor requirements.

8 Individual rights and regulatory assistance

Runeward Labs promptly forwards a request concerning Customer Personal Data to the customer, unless legally prohibited, and does not independently respond on the merits except on instructions or where law requires. Taking account of the processing, it provides appropriate technical and organisational assistance with information, access, correction, deletion, restriction, portability, objections, appeals and qualifying automated-decision rights.

Assistance includes locating data across relevant device, identity, activity, support and other records, explaining limitations, supplying available exports, and implementing instructed corrections or deletion. A whole-tenant deletion function is not a substitute for assessing an individual request. Runeward Labs supports the customer's applicable deadlines and supplies information progressively rather than waiting for every record to be located. Verification and disclosures must remain proportionate and protect other people and customers.

Runeward Labs also provides information reasonably needed for assessments, records of processing, prior consultation, regulatory inquiries and customer compliance duties arising from the instructed service. Routine statutory assistance is included. Any extraordinary optional work or agreed third-party expense must be agreed in advance and must not obstruct legally required assistance or remedies.

9 Personal data breaches and security incidents

Runeward Labs notifies the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and on awareness where NDPA section 40 requires. It does not wait for a completed investigation or for a controller's regulatory reporting deadline to expire. Any shorter applicable statutory or agreed sectoral deadline controls.

The initial notice gives available information about the nature and time of the incident, affected systems, categories and approximate numbers of individuals and records, likely consequences, containment and remedial action, and a contact for follow-up. Runeward Labs supplements the notice as facts become known, preserves relevant evidence, investigates and takes appropriate containment and remediation measures. It assists the customer with its assessment and required authority or individual notices. Notice is not, by itself, an admission of fault.

Runeward Labs will not identify the customer in a public incident statement or notify affected individuals on the customer's behalf without instructions unless required by law. Where permitted, it will first consult the customer. Separate obligations concerning exploited vulnerabilities, product security or non-personal-data incidents may apply even where the event is not a personal data breach. Those obligations are not displaced by this clause.

10 Assessments and audits

Runeward Labs provides information needed to demonstrate compliance with this Processing Agreement and allows and contributes to appropriate audits, including inspections, by the customer or an independent auditor it appoints. Written questionnaires, relevant reports and remote evidence may be used where sufficient, but are not an absolute substitute for inspection where necessary.

Routine audits will ordinarily be limited to once in a 12-month period, on 30 days' notice, during reasonable hours, subject to confidentiality and safeguards for other customers and systems. Those limits do not prevent a regulator's access, an audit following a material incident or credible non-compliance concern, or another audit required by law or an applicable transfer instrument. Urgent reviews use reasonable shorter notice. Neither party may use audit confidentiality to conceal relevant non-compliance.

The customer ordinarily bears its own auditor's costs. Runeward Labs bears its remediation costs and reasonable costs of demonstrating correction of its material breach. Any other exceptional assistance charges must be agreed in advance and must not defeat statutory audit rights. Runeward Labs provides remediation plans and follow-up evidence for material findings.

11 Return, deletion, retention and holds

During the service, Runeward Labs applies the documented retention schedule and customer instructions, including any shorter supported period. Each category must have a purpose, a retention limit or sufficiently specific criteria, and a disposal process. Indefinite technical storage is not an instruction to retain information indefinitely. The separate retention rules for incident, audit, response, inventory and evidential records in Schedule A continue to apply beyond the general activity-history period where their stated purpose remains valid.

At the end of processing, the customer chooses return or deletion of Customer Personal Data, unless applicable law permits a required retention exception. For GDPR Article 28(3)(g), the exception is retention required by Union or Member State law; a conflicting third-country requirement must be assessed under clause 12 and cannot silently override this obligation. The customer ordinarily has 30 days to retrieve data after termination; any mandatory switching or retrieval period in the Agreement controls. Runeward Labs supplies a reasonably usable export of the customer's data and relevant metadata, subject to protection of other people, security and non-exportable proprietary materials. A fee or plan restriction must not defeat a mandatory return or individual-rights duty.

Runeward Labs deletes live copies within 30 days after completion of return or a valid deletion instruction, or earlier where required. Backup copies are deleted under the requirements in Schedule B, remain access restricted, are not used for ordinary service activity, and have applicable deletions reapplied after restoration. The customer can request written confirmation of completion and any lawful retention exception. Any exception identifies the basis, scope, access restriction and disposal trigger; it is not a blanket audit-log exemption.

The customer controls local device files, offline copies and exports to its own destinations. Runeward Labs provides information reasonably needed for coordinated disposal. Global business records, including independent account or invoice records, are governed by the Privacy Policy and their applicable legal basis; they cannot be used to retain customer telemetry for a new purpose.

12 International processing and government access

Runeward Labs discloses the relevant storage, backup, support and administrative-access locations to the customer under Schedule C. The provider's legal domicile, hosting region and users' locations are separate facts. Runeward Labs will not make a restricted international transfer, including access by a separate third-country recipient where applicable, unless the required mechanism, assessment and supplementary safeguards are established and documented in accordance with Schedule D.

For GDPR transfers, the parties apply Chapter V to the particular disclosure and recipient. The 2021 EU transfer clauses are used only within their lawful scope. The parties assess separately whether the importer's relevant processing is already directly subject to GDPR Article 3; inserting those clauses cannot resolve an ineligible use. If another approved instrument or authorisation is needed, it must be completed before that flow starts. Routine continuous telemetry must not rely on an Article 49 exception merely because a customer accepted the service.

Outbound-transfer requirements under NDPA sections 41 to 43 and applicable NDPC instruments are assessed separately. An EU instrument or a privacy policy does not itself establish NDPC approval. UK restricted transfers, where applicable, require a valid UK mechanism and assessment; the fact that EU clauses have been signed is insufficient without the necessary UK instrument.

Runeward Labs reviews the legality and scope of compulsory access requests, challenges requests where there are reasonable legal grounds, discloses only legally required data, and informs the customer where lawful. It seeks permission to notify where disclosure is prohibited and records the request and response. It does not voluntarily provide unrestricted direct access. It assists with the customer's transfer assessment, including relevant onward access and safeguards. If the required protection cannot be maintained, the affected transfer is suspended or brought to a lawful end and the parties address return or deletion.

13 Additional service provider and processor terms

Where Runeward Labs receives personal information as a service provider or contractor under the California Consumer Privacy Act, the parties intend a limited business-purpose disclosure for endpoint security detection, device and tool inventory, authorised policy and response execution, evidence management, customer reporting and support, as specified in Schedule A. Runeward Labs will comply with applicable CCPA obligations and provide the same level of privacy protection required of the customer for that information.

Runeward Labs will not sell or share that information; retain, use or disclose it outside the specified purposes or direct business relationship, except as expressly permitted by applicable law; or combine it with information from other customers or its own interactions except to the extent law permits within the specified service-provider purpose. These exceptions do not authorise advertising, independent profiling or shared model training contrary to this Processing Agreement.

Runeward Labs certifies that it understands and will comply with the applicable restrictions when acting as a contractor. It notifies the customer promptly if it determines it can no longer meet its obligations. The customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorised use. Runeward Labs cooperates with those steps, individual-rights requests, applicable assessments and audits, and binds any subprocessor to the required terms.

Under other applicable US state processor laws, Runeward Labs adheres to instructions, ensures confidentiality, assists the controller with rights, security, breach notices and required assessments, supplies compliance information, permits legally required assessments, and returns or deletes information as required. The nature, purpose, data types, duration and parties' rights are specified in this Processing Agreement and Schedule A. State-specific rights, exemptions and deadlines continue to control. This Processing Agreement does not by itself constitute a HIPAA business associate agreement or establish compliance with a regulated customer's sectoral obligations. Actual legal roles and information processed determine sector duties; a prohibition or an unintended disclosure does not itself exclude them. The parties must assess an affected deployment promptly and put required controls and additional agreements in place before continuing regulated processing.

14 Liability, remedies and changes

The Agreement's liability terms apply between the parties only to the extent permitted by mandatory law and valid applicable transfer clauses. They do not remove an individual's statutory rights, a supervisory authority's powers, mandatory compensation obligations or protected third-party-beneficiary rights. Neither party obtains a statutory defence merely because the other accepted this Processing Agreement.

The Processing Agreement continues for as long as Runeward Labs retains Customer Personal Data. Material changes require the parties' agreement, except changes needed to comply with binding law that do not reduce protection; Runeward Labs gives reasonable advance notice and explains their effect. If a lawful protective arrangement cannot be maintained, the affected processing must stop. Technical documentation cannot silently override the purposes, categories or safeguards agreed here.

Schedule A: Processing particulars and instructions

Subject matter: provision of the runeguard service and authorised support ordered by the customer. The applicable order and authorised configuration determine whether the service is Runeward Labs hosted, customer operated or local only, and identify the customer-selected sync destination. Only processing within clause 1 is covered. Duration: the service term, the return and deletion periods in clause 11 and any specifically identified lawful retention. Frequency: continuous or event-triggered for enabled enrolled-device and Console functions; ad hoc for support, assessments and customer instructions.

Purposes and operations: for data within clause 1, instructed receipt, recording, organisation, correlation, analysis, display, access control, customer-authorised response, export, support, retention and erasure. Local inspection and policy evaluation on customer-controlled devices are not attributed to Runeward Labs merely because it supplies the software. The service is a security tool; employee scoring, advertising or unrelated research is not authorised by this schedule.

Data subjects: authorised Console and service users; employees, contractors and other people associated with managed devices or directories; customer business contacts; and people whose information is incidentally included in authorised support, session or assessed-resource content.

Data categories: device and installation identifiers; customer labels; OS, version, health and enrollment records; public signing keys and certificates; event times, detections and policy decisions; AI tool, process and session correlators; path or content digests; relevant network destinations and traffic metadata; tool, package, extension and MCP inventory; directory and account names, work emails, roles, groups and identifiers; administrative and incident histories; support messages and attachments; and any explicitly enabled content or optional observation described below. Treat linkable hashes and redacted text as personal data where identifiable.

Baseline sync: enrolled devices configured to synchronise can send agent-activity and device-operation events (AgentActivity and DeviceOperations) independently of the session-content and human-to-AI-sharing switches. The destination may be a customer-operated self-hosted endpoint or Runeward Labs' hosted service. Disabling those optional switches does not itself disable baseline sync or make a hosted deployment local-only. The customer-selected destination and enabled baseline data categories form part of its documented instructions; Runeward Labs must retain a record of those instructions and material changes.

Optional human AI sharing checks, session content, remote-session metadata, document-label inspection, identity connectors, exports and response integrations are authorised only to the extent enabled by an authorised customer administrator or separately instructed in writing. Human AI sharing checks and session content retention and upload are off by default. Enabling a feature does not authorise unrelated collection or use. Incident escalations must have a recorded scope, authorised approvers, expiry and retention period; the supported default requires a second approver unless the customer changes that setting. Session excerpts are limited to 2,048 bytes, with retention from 1 to 90 days and a default of 30 days. Pattern-based redaction is not guaranteed removal of all sensitive information.

Special-category or regulated data is not a target of ordinary security telemetry, but it can occur in content or support material. Deliberate processing requires a separate documented instruction identifying the necessary categories, applicable additional legal condition, authorised access and protective measures, together with any required sector agreement. This Processing Agreement does not authorise such deliberate processing by default. Incidental information remains protected and must be minimised and addressed under the customer's lawful instructions.

Activity history: Startup defaults to 90 days, with a supported customer setting of 30 to 90 days and a default 30-day grace after a downgrade or loss of long-history entitlement. Incident-linked material and the newest collector record follow the separate rules below. Enterprise history has no automatic expiry; it is subject to the customer's documented retention and deletion instructions. An absence of automatic expiry does not authorise indefinite retention without a valid purpose. Runeward Labs must implement an agreed shorter period before accepting processing that depends on it.

Other technical records: session content follows the 1-to-90-day setting described above, defaulting to 30 days. Inventory counts and MCP activity default to 200 days, with supported bounds of 186 to 730 days; an agreed shorter period requires a separate disposal process. Current-state and device records are retained for the authorised service and security lifecycle, including access revocation and replay prevention. Removal of a directory entry does not itself delete related security evidence.

Incidents, held findings, audit, chain, export and response records do not all follow routine activity-history expiry. Retention is limited to the customer's documented investigation, verification or evidential purpose, or a valid legal hold. The customer and Runeward Labs must review the need when an incident closes, an instruction changes or the relevant claim or obligation ends. Support cases and attachments are retained for the case, necessary follow-up and any related documented dispute or legal hold. Once the relevant purpose ends, the return and deletion requirements in clause 11 apply. Backup disposal is governed by Schedule B. A change of purpose or retention extension requires a lawful documented instruction or a valid statutory exception.

The customer must document its lawful basis, any additional sensitive-data condition, required impact assessment, privacy notices and relevant workplace authorisation. Runeward Labs provides the information and assistance required by clauses 4 and 8 and documents assessments for which it is responsible. This allocation does not make Runeward Labs the decision maker for the customer's monitoring purposes or legal basis.

Schedule B: Technical and organisational measures

Runeward Labs must implement and maintain the measures below for the processing it performs. They are contractual commitments, not a certification or guarantee that breaches cannot occur. Customer-controlled infrastructure remains subject to the responsibilities in clause 6.

Identity and access: customer requests are authorised within their tenant; privileged operational access is separately restricted. Use least privilege, controlled enrollment and revocation, appropriate multi-factor protection for administrative access, timely access removal and periodic access review. Authenticated post-enrollment device requests use device signing and replay checks. Bootstrap and recovery processes are separately controlled.

Data separation and minimisation: enforce tenant authorisation and database row restrictions using appropriately constrained runtime roles. Validate transmitted schemas and data types. Minimise free text and customer labels. Keep content collection separate from ordinary telemetry, apply configured redaction, limit excerpt size and lifetime, and record authorised content reads. Do not describe a hash as anonymous merely because it is not a clear-text path.

Transport and storage: use authenticated encrypted transport with certificate validation for customer-data transfers over public or untrusted networks. Document the protection of internal service and database connections and any isolated-network exceptions with compensating controls. Protect credentials and keys, separate secrets from ordinary logs, and restrict local file permissions. Apply risk-appropriate encryption, access restrictions and key management to hosted data and backups, and provide the customer with relevant security information on request. The customer controls disk and local-file protection on its own devices and infrastructure. Encryption of the offline queue or selected secrets is not a representation that every local spool or database field is encrypted.

Integrity and audit: verify signed catalogues and relevant updates; authenticate device submissions; maintain the supported endpoint finding-chain integrity checks; record relevant administrative, content-access, support-grant and security events. Protect and review logs with defined retention. Ordinary application audit logs are not represented as an immutable cryptographic ledger.

Operational safeguards: maintain vulnerability intake, risk-based patching, secure development and change review, dependency assessment, staff training, confidentiality, supplier due diligence, incident response and access governance. Regularly test and evaluate relevant controls, retain evidence of the results and address material deficiencies. Assess the physical and infrastructure safeguards of engaged hosting providers. The customer may obtain relevant evidence under clause 10, subject to the confidentiality protections there.

Availability and deletion: maintain backups and recovery procedures appropriate to the agreed service, test restores and reapply deletion instructions after restoration. Before using a backup arrangement for Customer Personal Data, Runeward Labs must disclose its processing locations, maximum retention period and deletion method to the customer. Backup retention must be limited to the documented recovery purpose and applicable law. Following a deletion instruction, residual backups must be isolated from ordinary use and erased or overwritten within that disclosed period, or sooner where law requires. Restoration must not reinstate deleted data for ordinary use. No fixed recovery-time or recovery-point guarantee applies unless expressly agreed in the order. Operate and verify retention, deletion, export and individual-rights workflows, including records excluded from general history purges.

Assurance and insurance: no certification, independent assurance report or insurance cover is represented by this Processing Agreement alone. Any expressly agreed assurance or cover must identify its actual scope in the applicable order or written confirmation. Insurance does not replace the duties or allocate liability differently from the Agreement.

Schedule C: Subprocessor disclosure and authorisation

OVHcloud is the hosting brand used for Runeward Labs' hosted service. This identifies the hosting role; it does not by itself identify or authorise a particular contracting entity, processing location or international transfer.

Before Customer Personal Data is made available to a subprocessor, Runeward Labs must provide the customer with written notice of its legal identity, services, relevant data categories, storage and access locations, and applicable transfer safeguards. The initial disclosed subprocessors require the customer's written authorisation, which may be recorded in the accepted order. Subsequent additions or replacements are governed by the general authorisation, notice and objection process in clause 7. Undisclosed providers are not authorised by a reference to hosting, email, backup or another service category.

Runeward Labs must keep that information current and accessible to the customer, disclose material location or service changes before they take effect, and apply clause 12 to any resulting restricted transfer. Customer-controlled infrastructure and recipients are determined by the customer's documented instructions; their use does not establish Runeward Labs access or make them its subprocessors.

Schedule D: International transfer safeguards

This Processing Agreement does not itself constitute a completed international transfer instrument. Before a restricted transfer begins, the parties must establish a legally available mechanism for the actual parties, roles, data and destinations, and document any required assessment and supplementary safeguards. Routine service use does not by itself provide a transfer derogation or authorisation.

Where eligible EU standard contractual clauses are used, the parties must expressly agree the applicable modules and options, required annex particulars and binding acceptance. The official clauses control and take priority as provided in clause 1. Controller-to-processor and processor-to-subprocessor transfers require the module appropriate to each relationship. No module, governing law, court or supervisory authority is selected merely by this document or by a hosting region. The competent supervisory authority is determined under the applicable law and transfer instrument.

Where the importer or processing is outside the scope of a particular standard instrument, the parties must establish a legally available alternative. Applicable UK and other domestic outbound-transfer requirements are assessed separately; an EU instrument alone does not establish compliance with another transfer regime. If a required safeguard is absent or ineffective, the affected transfer must not begin or must be suspended, with return or deletion handled under clauses 11 and 12.

Schedule E: Acceptance and communications

This Processing Agreement takes effect when validly incorporated into an order accepted by both parties or otherwise agreed by their authorised representatives in writing, including electronically where applicable law permits. The order or acceptance record must identify each contracting legal entity and address, the agreed service, the accepting representatives and the date of acceptance. A separate signature on this document is unnecessary where the incorporation and acceptance are legally effective. Any transfer instrument remains subject to its own execution requirements.

Runeward Labs' privacy contact is [email protected]. Product support and security incident reports may be sent to [email protected]. The customer must nominate and maintain a monitored privacy and security contact through its order, account administration or written notice. Runeward Labs uses that contact for breach notices and subprocessor communications; each party must keep the other informed of changes. Formal contractual notices follow the service agreement.

Legal authorities

The core processing provisions address GDPR Article 28, with Articles 5, 24, 25, 30, 32 to 36 and 44 to 49; Nigeria Data Protection Act 2023 (NDPA), sections 24 to 32 and 39 to 43, and the NDPC General Application and Implementation Directive 2025 (GAID), including Articles 31, 33, 34 and 45; and applicable US processor or service-provider requirements, including California Civil Code sections 1798.100 and 1798.140 and 11 CCR sections 7050 and 7051. A compliance assessment must consider the actual processing and relevant national or sector rules.

GDPR official text · NDPA 2023 official text · NDPC GAID 2025 · EU transfer clauses Decision 2021/914 · Commission transfer clause guidance · California law and regulations · UK international transfer guidance.