Data Processing Addendum

Last Revised: September 29, 2026

This Data Processing Addendum (“DPA”) is an agreement between you or the entity you represent (“Customer” or “Data Controller”) and Currents Software Inc. (“Currents” or “Data Processor”).

This DPA shall be added as an addendum to (a) the Currents’s Terms of Use available at https://currents.dev/tos, as updated from time to time, and/or (b) any other agreements executed between the Customer and Currents governing Customer’s use of Currents’s services, which include data processing services (respectively, the “Services” and the “Services Agreement”), in each case where Data Protection Laws (as defined below), including the EU General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“GDPR”), apply to Personal Data (as such term is defined below) processed by Currents in order to provide the Services to the Customer.

Data Controller and Data Processor shall be collectively referred to as the “Parties”, and each a “Party”.

1. Definitions.

In this DPA, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

“Affiliate(s)” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership of either Party, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;
“Applicable Laws” means any applicable law, including Data Protection Laws, to which Data Processor is subject with respect to any Personal Data;
“Data Protection Laws” means, to the extent applicable to the Processing of Personal Data under this DPA: (a) the GDPR, as transposed into domestic legislation of each Member State of the European Economic Area; (b) the UK GDPR and the UK Data Protection Act 2018 (together, “UK Data Protection Laws”); (c) the Swiss Federal Act on Data Protection (“FADP”); (d) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and its regulations (“CCPA”); and (e) the Canada privacy laws; in each case as amended, replaced or superseded from time to time;
“EEA” means the European Economic Area;
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) (an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person), which is Processed by Data Processor or any of Data Processor’s Sub-processors on behalf of Data Controller as part of the performance of the Services under the Services Agreement, all to the extent that such data is subject to Data Protection Laws. Personal Data includes “personal information” as defined in the CCPA;
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses annexed to the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021, as amended, replaced or superseded from time to time;
“Sub-processor” means any third party (but excluding an employee of Data Processor) appointed by or on behalf of Data Processor to Process Personal Data for the benefit of Data Controller as part of the performance of the services under the Services Agreement;
“Supervisory Authority” means (a) an independent public authority which is established by a Member State of the European Economic Area pursuant to Article 51 of the GDPR; and (b) any similar regulatory authority responsible for the enforcement of Data Protection Laws;
“Term” shall have the meaning ascribed to it under Section ‎12 below; and
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under S119A(1) of the UK Data Protection Act 2018, as amended or replaced from time to time.

2. Processing of Personal Data

2.1.

Data Processor, and any person acting under its authority, will carry out the Personal Data Processing activities, including with regard to transfers of Personal Data to a third country or an international organisation, only for the following purposes: (i) to provide the Services during the Term in accordance with the Services Agreement and other reasonable documented instructions provided by the Data Controller, where such instructions are consistent with the terms of the Services Agreement (collectively, the “Instructions”); and (ii) as required under Applicable Law, in which case Data Processor shall, to the extent permitted by Applicable Law, inform Data Controller of such legally required Processing of Personal Data, unless that law prohibits such information on important grounds of public interest.

2.2.

Data Controller instructs Data Processor (and authorises Data Processor to instruct each of its Sub-processors) to process the Personal Data, as reasonably necessary for the provision of the Services and in accordance with the Services Agreement and this DPA. Additional Instructions outside the scope of this DPA and the Services Agreement require prior written agreement between Data Controller and Data Processor and will include any additional fees that may be payable by the Data Controller to the Data Processor for carrying out such Instructions.

The Services include optional AI Features (as defined in the Services Agreement) that send Customer Content (as defined in the Services Agreement), which may include Personal Data, to third-party AI providers. Administrators of the Data Controller control whether the AI Features are enabled and can enable or disable them at any time through the Services. While the AI Features are enabled, that constitutes the Data Controller’s documented Instruction to Data Processor to engage the AI provider Sub-processors listed at https://currents.dev/sub-processors for the purpose of providing the AI Features, and Data Controller may withdraw that Instruction at any time by disabling the AI Features. Data Controller is responsible for deciding whether its Customer Content may be sent to AI providers.

While the use of Customer Content to improve the Services is enabled, Data Controller instructs Data Processor to de-identify Customer Content, including any Personal Data it contains, and authorises Data Processor to use the de-identified data to develop and improve the Services, as described in the “Improving the Services” paragraph in Section 5 of the Services Agreement. Administrators of the Data Controller control whether this use is enabled and can turn it off at any time through the Services. Data that has been de-identified so that it no longer relates to an identified or identifiable individual is not Personal Data.

2.3.

Data Processor will notify Data Controller if Data Processor is of the opinion that a written Instruction received from Data Controller is in violation of Applicable Law and/or in violation of contractual duties under the Services Agreement.

2.4.

Data Processor shall treat Personal Data as confidential information and will not disclose, make available or transfer the Personal Data to any third party, other than as permitted under this DPA.

2.5.

Data Controller shall have sole responsibility for the accuracy, quality and legality of the Personal Data and the means by which Data Controller acquired the Personal Data. Data Controller warrants and undertakes that the Personal Data has been collected, Processed and transferred in accordance with the laws applicable to Data Controller, including, if required by applicable law, that Data Controller has received all required consents from the applicable Data Subjects for the Processing carried out by the Data Processor under this DPA and the Data Subjects have been informed that their Personal Data could be transmitted to a third country outside of the EU/EEA.

2.6.

Exhibit 1 of this DPA sets forth certain information regarding Data Processor’s Processing activities of the Personal Data, as required by Article 28(3) of the GDPR.

2.7.

Unless Data Processor has given its prior written approval, Data Controller shall not provide to Data Processor any special categories of personal data described in Article 9 of the GDPR (such as data concerning health, genetic or biometric data, or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation) or personal data relating to criminal convictions and offences (“Sensitive Data”). Data Controller is solely responsible for any Sensitive Data it provides in breach of this Section.

2.8.

To the extent the CCPA applies, Data Processor is a “service provider” as defined in the CCPA and shall not: (a) sell or share Personal Data; (b) retain, use or disclose Personal Data for any purpose other than the business purposes set out in the Services Agreement and this DPA, including those described in Section 2.2; (c) retain, use or disclose Personal Data outside the direct business relationship between the Parties; or (d) combine Personal Data with personal information it receives from other sources, except as permitted by the CCPA. Data Processor will notify Data Controller if it determines that it can no longer meet its obligations under the CCPA, and Data Controller may then take reasonable steps to stop and remediate any unauthorized use of Personal Data.

2.9.

Data Processor processes the information it collects to create and manage the accounts of Data Controller’s users, and to secure, support and bill the Services, such as email addresses, names where provided, and IP addresses (“Account Data”), as an independent controller in accordance with its Privacy Policy at https://currents.dev/privacy-policy, and not on behalf of Data Controller. Account Data is not Personal Data under this DPA. The same information contained in data that Data Controller sends to the Services, such as source-control metadata or test output, remains Personal Data.

3. Data Subjects

3.1.

Data Processor shall promptly notify Data Controller if Data Processor receives a request from a Data Subject to exercise the Data Subject’s rights under Data Protection Laws, including without limitation the right of access, rectification, restriction of Processing, erasure, data portability, object to the Processing, or its right not to be subject to an automated individual decision making (“Data Subject Request”), and shall not respond to such request without Data Controller’s prior written consent, except to confirm that such request relates to Data Controller.

3.2.

Taking into account the nature of the Processing, Data Processor has implemented in the Services certain technical and organisational measures to assist the Data Controller in independently fulfilling its obligation to respond to Data Subject Requests. However, due to technical limitations and the nature of the Services, not all Personal Data may be retrieved, accessed, amended, ported or restricted. Notwithstanding, all Personal Data is automatically deleted according to the retention periods described at https://docs.currents.dev/resources/data-privacy/data-retention (or as otherwise set by the Data Controller) and may also be deleted at any time by the Data Controller, at its sole discretion. To the extent that Data Controller, while using the Services, does not have the ability to address a Data Subject Request, Data Processor shall, upon Data Controller’s request, make commercially reasonable efforts to assist Data Controller in responding to such Data Subject Request, to the extent Data Processor is technically capable to do so. Data Processor may charge Data Controller reasonable fees for such assistance.

4. Supervising Authorities

Data Processor shall provide reasonable assistance to Data Controller with any data protection impact assessments, and prior consultations with Supervising Authorities, as required by article 35 and 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to the Processing of Personal Data by Data Processor and all by taking into account the nature of the Processing and information available to the Data Processor. Data Controller acknowledges and agrees that assistance with data protection impact assessments and prior consultations by Data Processor may result in additional fees (which will be notified to Data Controller in advance).

5. Security Breach Notification

5.1.

Data Processor shall notify Data Controller without undue delay after becoming aware of a Personal Data Breach affecting the Personal Data. Data Processor’s notification of or response to a Personal Data Breach is not an acknowledgement of any fault or liability.

5.2.

Data Processor shall provide Data Controller with sufficient information to allow Data Controller to meet any obligations to report or inform Supervising Authorities and Data Subjects of the Personal Data Breach under the Data Protection Laws, taking into account the nature of Processing and the information available to Data Processor, including with the following information: (a) a description of the nature of the Personal Data Breach, including the categories and approximate number of both Data Subjects and Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) a description of the measures taken, or proposed to be taken, to address the Personal Data Breach, including measures to mitigate its possible adverse effects. To the extent Data Processor does not have full information about the Personal Data Breach at the time of the initial notification, Data Processor shall provide an initial notification and then supplement that with additional information as it becomes available.

6. Audit

6.1.

During the Term, Data Processor shall keep records of its Processing activities in accordance with applicable Data Protection Laws.

6.2.

During the Term and upon written request, Data Processor shall make available to Data Controller information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and this DPA, including a copy of Data Processor’s most recent SOC 2 Type II report or other third-party audit report (“Audit Report”), which is Data Processor’s confidential information. If the Audit Report and such information are not sufficient to demonstrate Data Processor’s compliance with this DPA, Data Processor shall allow for and contribute to audits, including inspections, conducted by Data Controller or another auditor mandated by Data Controller, only in order to verify Data Processor’s compliance with this DPA. Data Controller shall bear all costs of any such audit, including reasonable compensation for the time of Data Processor’s personnel. If and to the extent Data Controller engages third parties to conduct the audit, such third parties must be bound to strict confidentiality obligations. Data Controller shall only be entitled to conduct such audit during business hours and no more than once in any twelve (12) month period, except where an audit is required by a Supervisory Authority. Audits under Clause 8.9 of the Standard Contractual Clauses shall be carried out in accordance with this Section 6.

6.3.

Data Controller shall provide Data Processor a reasonable prior written notice of any audit or inspection to be conducted under this Section and shall avoid (and ensure that each of its auditors avoids) causing any damage, injury or disruption to Data Processors’ premises, equipment, personnel and business while its personnel are on those premises in the course of such audit or inspection.

6.4.

It is agreed that a copy of this DPA may be forwarded to the relevant Supervisory Authority, if required under applicable Data Protection Laws. Furthermore, the Parties agree that such authority has the right to conduct an audit of the Parties with respect to the subject matter of this DPA.

6.5.

Nothing in this DPA will require Data Processor either to disclose to Data Controller (and/or its authorized auditors), or provide access to: (i) any data of any other customer of Data Processor; (ii) Data Processor’s internal accounting or financial information; (iii) any trade secret of Data Processor; or (iv) any information that, in Data Processor’s sole discretion, could compromise the security of any of Data Processor’s systems or premises or cause Data Processor to breach obligations under any Applicable Law or its obligations to any third party.

7. Sub-processing

7.1.

Data Controller hereby (i) grants Data Processor a general authorization to engage (and permits each Sub-processor appointed in accordance with this Section to engage) Sub-processors for the purpose of providing the Services; (ii) agrees that Affiliates of Data Processor (including without limitation Currents Software Inc.) may be used as Sub-processors; and (iii) confirms that Data Processor may continue to use those Sub-processors already engaged by Data Processor as of the Effective Date of this DPA, which are detailed in the Company’s dedicated webpage at https://currents.dev/sub-processors (“Existing Sub-processors”).

7.2.

Data Processor can at any time and without justification appoint a new Sub-processor, provided that prior to engaging any Sub-processor:

(a) Data Processor will give notice of the engagement of a new Sub-processor at least fourteen (14) days in advance by updating the list at https://currents.dev/sub-processors. Data Controller may subscribe to receive such notices by email by writing to support@currents.dev. Data Controller may object to a new Sub-processor on reasonable data protection grounds by notifying Data Processor in writing within that fourteen (14) day period. If Data Processor does not address the objection, Data Controller may, as its sole and exclusive remedy, terminate the Services Agreement (or the affected Services) by written notice to Data Processor. No fees paid or payable will be refunded upon such termination.
(b) Data Processor ensures that it has in place a sub-processing agreement between Data Processor and the Sub-processor, that is no less protective with respect to Data Controller’s interest and protection of Personal Data than this DPA. Upon Data Controller’s request, Data Processor shall provide Data Controller with an updated list of Sub-processors and, where required by Data Protection Laws or the Standard Contractual Clauses, a summary of the data protection terms of its agreement with a Sub-processor or a copy of that agreement with commercial and other confidential information removed.
(c) Data Processor engages AI provider Sub-processors only under terms that prohibit the Sub-processor from using Personal Data to train or improve its models and that limit the Sub-processor’s retention of Personal Data to the period required to provide the service and to detect abuse. Data Processor may access an AI provider’s model through a hosting, gateway or routing service (such as Amazon Bedrock, Microsoft Azure or Google Cloud Vertex AI). Where that service is operated by a Sub-processor already listed at https://currents.dev/sub-processors and the location of Processing does not change, no additional notice under Section 7.2(a) is required for the use of that service.

7.3.

Where the Sub-processor fails to fulfil its personal data protection obligations with respect to the Personal Data, Data Processor shall remain fully liable to Data Controller for the performance of that Sub-processor’s obligations.

7.4.

Data Controller may connect the Services to third-party services it chooses, such as issue trackers, chat tools, webhooks or connected AI applications. Data Processor sends Personal Data to those services only on Data Controller’s instruction. Those services are not Sub-processors, and their processing of Personal Data is governed by Data Controller’s own agreements with them.

8. Transfers

8.1. Authorization

Data Controller authorizes Data Processor to transfer Personal Data to, and Process it in, countries outside the EEA, the United Kingdom and Switzerland, including the United States, where Data Processor and its Sub-processors listed at https://currents.dev/sub-processors are located, as necessary to provide the Services.

8.2. Transfers from the EEA

To the extent a transfer of Personal Data from Data Controller to Data Processor is subject to the GDPR and is not covered by an adequacy decision of the European Commission, the Standard Contractual Clauses are incorporated into this DPA by reference and the Parties are deemed to have entered into them, completed as follows:

(a) Module Two (controller to processor) applies where Data Controller is a controller, and Module Three (processor to processor) applies where Data Controller is a processor;
(b) Clause 7 (docking clause) does not apply;
(c) in Clause 9, Option 2 (general written authorization) applies, with the notice period and procedure set out in Section 7.2;
(d) in Clause 11, the optional language does not apply;
(e) in Clause 17, Option 1 applies, and the Standard Contractual Clauses are governed by the laws of Ireland;
(f) in Clause 18(b), disputes are resolved before the courts of Ireland;
(g) audits under Clause 8.9 are carried out in accordance with Section 6, and the certification of deletion described in Clauses 8.5 and 16(d) is provided only upon Data Controller’s written request; and
(h) Annex I is completed with Exhibit 1 of this DPA, Annex II with Exhibit 2 of this DPA, and Annex III with the list of Sub-processors referred to in Section 7.1.

8.3. Transfers from the United Kingdom

To the extent a transfer of Personal Data from Data Controller to Data Processor is subject to UK Data Protection Laws and is not covered by adequacy regulations under UK Data Protection Laws, the UK Addendum is incorporated into this DPA by reference and the Parties are deemed to have entered into it. Tables 1 to 3 of the UK Addendum are completed with the information in Section 8.2 and Exhibits 1 and 2 of this DPA, and in Table 4, the Importer may end the UK Addendum as set out in its Section 19.

8.4. Transfers from Switzerland

To the extent a transfer of Personal Data from Data Controller to Data Processor is subject to the FADP, the Standard Contractual Clauses apply as set out in Section 8.2, with the following changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term “Member State” in Clause 18(c) includes Switzerland, so that data subjects in Switzerland may bring claims in their place of habitual residence.

8.5. Onward transfers

Where Data Processor transfers Personal Data to a Sub-processor in a country that is not recognized as providing an adequate level of protection under Data Protection Laws, Data Processor shall ensure that the transfer is subject to appropriate safeguards under Data Protection Laws, such as the Standard Contractual Clauses or the Sub-processor’s certification under the EU-U.S. Data Privacy Framework.

8.6. Changes to transfer mechanisms

If a transfer mechanism relied on in this Section 8 is invalidated, amended or replaced, Data Processor may adopt an alternative transfer mechanism permitted by Data Protection Laws by notice to Data Controller.

8.7. Conflicts

If there is any conflict between this DPA and the Standard Contractual Clauses or the UK Addendum, the Standard Contractual Clauses or the UK Addendum shall prevail.

9. Personnel

Data Processor will be responsible for using qualified personnel with data protection training to provide the Services and ensure that Data Processor’s access to the Personal Data is limited only to those personnel who require such access to perform the Services. Data Processor shall obligate its personnel to Process the relevant Personal Data only in accordance with this DPA.

Data Processor will further ensure that its personnel authorised to Process the Personal Data on its behalf: (i) will do so only on a need-to-know basis; and (ii) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they will keep confidential and will not make available any Personal Data to any third party, other than as permitted herein.

10. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Data Processor will implement technical and organizational security measures in order to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR, as stipulated in Exhibit 2 of this DPA.

The technical and organizational security measures are aimed at protecting Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access and against all other unlawful forms of Processing.

The technical and organizational security measures are subject to technical progress and development and the Data Processor may update or modify technical and organizational security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services.

11. Deletion and Return of Personal Data

Upon termination of the Services Agreement and/or this DPA, Data Processor will delete or return to Data Controller, and instruct its Sub-processors to delete or return, all existing copies of the Personal Data which are in its possession.

Data Processor may retain the Personal Data to the extent required by Applicable Laws and only to the extent and for such period as required by Applicable Laws and always provided that Data Processor shall ensure the confidentiality of all such Personal Data and shall ensure that such Personal Data is only Processed as necessary for the purpose(s) specified in the Applicable Laws requiring its storage and for no other purpose.

12. Term

This DPA shall become effective upon execution or acceptance of the Services Agreement (“Effective Date”) and shall remain in full force until the later of the date when Data Processor ceases to Process the Personal Data or termination of the Services Agreement (the “Term”). All provisions of this DPA, which by their language or nature should survive the termination of this DPA, will survive the termination of this DPA.

13. Limitation of Liability

Each Party’s liability arising out of or related to this DPA, including under the Standard Contractual Clauses and the UK Addendum, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Services Agreement governing the Services. However, nothing in this DPA limits either Party’s liability to Data Subjects for their rights under the Standard Contractual Clauses or the UK Addendum.

14. Changes to this DPA

Data Processor may update this DPA by posting a new version at https://currents.dev/dpa. A new version applies to Data Controller from the start of Data Controller’s next subscription renewal period after it is posted, or earlier where Data Controller accepts it or where the change is required by Data Protection Laws or a Supervisory Authority. Any update is subject to compliance with any required obligations under applicable Data Protection Laws.

15. Miscellaneous

(i) This DPA represents the complete agreement concerning the subject matter hereof; (ii) except where explicitly agreed otherwise in writing by the Parties, in the event of inconsistencies between the provisions of this DPA and any other agreements between the Parties, including the Services Agreement and any other agreements which may be entered into or purported to be entered into after the date of this DPA, the provisions of this DPA shall prevail; (iii) the Parties to this DPA hereby agree to the governing law and the choice of jurisdiction stipulated in the Services Agreement with respect to any disputes or claims arising under this DPA; (iv) nothing in this DPA reduces either Party’s obligations under the Services Agreement in relation to the protection of Personal Data; and (v) should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (a) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (b) construed in a manner as if the invalid or unenforceable part had never been contained therein.

CUSTOMER HAS READ AND UNDERSTOOD THIS DPA AND AGREES TO BE BOUND BY ALL OF ITS TERMS AND CONDITIONS.

EXHIBIT 1

DETAILS OF PROCESSING OF PERSONAL DATA

This Exhibit 1 also serves as Annex I to the Standard Contractual Clauses.

A. List of Parties

Data exporter

Name: Data Controller (Customer), as identified in its Currents account
Address: Data Controller’s address as provided in its Currents account or billing details or, if none is provided, the email address of Data Controller’s account owner
Contact person: Data Controller’s account owner
Activities relevant to the transfer: use of the Services, as described in Section B below
Signature and date: by accepting the Services Agreement
Role: controller (or processor, where Data Controller uses the Services to process personal data on behalf of its own clients)

Data importer

Name: Currents Software Inc., a British Columbia corporation
Address: 1055 Dunsmuir Street, Suite 3000, Vancouver, BC V7X 1K8, Canada
Contact person: Andrew Goldis, Founder, support@currents.dev
Activities relevant to the transfer: provision of the Services, as described in Section B below
Signature and date: by accepting the Services Agreement
Role: processor

B. Description of the Processing and Transfer

1. Subject matter of the Processing

The subject matter of the Processing of the Personal Data are as set forth in the Services Agreement, as supplemented by this DPA.

2. Duration

As between Currents and Customer, the duration of the data processing activities under this DPA is determined by the Customer.

3. The purpose of the Processing

The purpose of the data processing under this DPA is the provision of the Service, as set forth in the Services Agreement.

4. Nature of the Processing

Quality assurance, software testing and such other Services as set forth in the Services Agreement, and, where enabled by the Data Controller, AI-assisted analysis of Customer Content by third-party AI providers as described in the Currents AI Terms at https://currents.dev/ai-terms, and, where enabled, de-identification of Customer Content to develop and improve the Services.

5. Type of Personal Data

Personal Data uploaded to the Services under Customer’s accounts in Currents’s Services, which may include: source-control metadata, such as commit author names and email addresses; and any personal data contained in test results, logs, screenshots, videos and traces that Customer sends to the Services, and in prompts submitted to, and outputs generated by, the AI Features. Where the AI Features are enabled, this Personal Data may be sent to AI provider Sub-processors.

6. Categories of data subjects

The Data Subjects may include Customer’s customers, employees, suppliers and end-users or any other type of data subject set forth in the Services Agreement.

7. Sensitive Data

None, unless approved in writing by Data Processor (Section 2.7).

8. Frequency of the transfer

Continuous, for the duration of the Services.

9. Retention

Personal Data is retained as described in Section 3.2 and at https://docs.currents.dev/resources/data-privacy/data-retention, and deleted or returned as described in Section 11.

10. Transfers to Sub-processors

Sub-processors listed at https://currents.dev/sub-processors Process Personal Data for the subject matter, nature and duration described in this Exhibit 1, as set out for each Sub-processor on that page.

C. Competent Supervisory Authority

The supervisory authority of the EU Member State in which Data Controller is established or, where Data Controller is not established in the EU, the supervisory authority determined in accordance with Clause 13 of the Standard Contractual Clauses. For transfers under Sections 8.3 and 8.4, the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner, respectively.

EXHIBIT 2

TECHNICAL AND ORGANIZATIONAL MEASURES

Description of the technical and organizational security measures implemented by Data Processor according to Section 10 of the DPA. This Exhibit 2 also serves as Annex II to the Standard Contractual Clauses.

Specific measures include:

Encryption of Personal Data in transit using TLS.
Encryption of Personal Data at rest using AES-256.
Infrastructure spread across two AWS availability zones, with periodic backups, to restore availability and access after an incident.
Annual SOC 2 Type II audit by an independent auditor.
Data retention limits as described at https://docs.currents.dev/resources/data-privacy/data-retention.
Sub-processors are bound by written agreements as described in Section 7.2(b).

Further information is available at https://currents.dev/security.

Currents implements the following control measures aligned with industry's best practices and reasonable effort to ensure secure and responsible processing of Personal Data:

Control Environment
Vendors and Supply Chain Evaluation
Risk Assessment
Risk Mitigation
Information and Communication
Access Control, User and Permissions Management
Production Environment Logical Access
Software Development Lifecycle
Infrastructure Change Management
Production Environment
Network Infrastructure
Production Monitoring
Data Center Security
Infrastructure Security
Application Security
Operational Security
Data Encryption
Support
Availability Procedures and Disaster Recovery