Data Processing Agreement

Version 1.0, March 3rd 2026

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between Heist AS and the Customer (as defined in the Terms of Service). By accepting the Terms of Service, the Customer agrees to this DPA. This DPA applies to the extent that the Processor processes Customer Data on behalf of the Controller in connection with the Service.

Heist AS, with company registration no. 935 833 973 (the "Processor"); and

The Customer, as identified in the Customer's account with the Service (the "Controller"),

each referred to as a "Party" and together as the "Parties".

Table of Contents

1. Introduction

2. Implementation timelines

3. The Controller's instructions

4. Security of processing

5. Personal Data breach

6. Sensitive data

7. Use of sub-processors

8. International transfers

9. Assistance to the controller

10. Documentation, audits and inspections

11. Data retention

12. Term and termination

13. Liability

14. Costs for complying with this DPA

15. Communications

16. Amendments

17. Choice of law and legal venue

1. Introduction

1.1 Purpose

1.1.1 The purpose of this DPA is to ensure that the Processor's processing of personal data on behalf of the Controller (i.e. Customer Data) is performed in compliance with Data Protection Law.

1.2 Annexes

1.2.1 The following Annexes are incorporated into this DPA by reference:

• Annex I: Processing Details

• Annex II: List of Approved Sub-Processors

• Annex III: Technical and Organisational Measures

1.3 Structure and interpretation

1.3.1 Annex I to Annex III are an integral part of this DPA.

1.3.2 Where this DPA uses terms and expressions defined in the GDPR, those terms shall have the same meaning as in the GDPR, unless a different meaning has been ascribed to the term and/or expression in this DPA. For clarity, the foregoing shall apply regardless of whether the terms and expressions defined in the GDPR are used in their capitalised form in this DPA.

1.3.3 This DPA shall be read and interpreted in the light of the provisions of the Data Protection Law.

1.3.4 This DPA shall not be interpreted in a way that runs counter to the rights and obligations provided for in the GDPR, or in a way that prejudices the fundamental rights or freedoms of the data subjects.

1.3.5 For the purpose of this DPA, capitalised terms shall have the meaning assigned to them in the definition list below. Terms defined in the Terms of Service and not separately defined in this DPA shall have the meaning given to them in the Terms of Service.

"Customer Data" means the personal data which the Processor will process on behalf of the Controller as further described in Annex I. For the avoidance of doubt, "Customer Data" as used in this DPA refers only to personal data and is narrower than the definition of "Customer Data" in the Terms of Service.

"Data Protection Law" means the applicable Norwegian law implementing and supplementing the GDPR.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

"Terms of Service" means the Terms of Service between the Controller and the Processor, available at https://heisthq.com/terms-of-use, as amended from time to time.

"Member State" means EU/EEA or EU/EEA member state.

"Personal Data Breach" means a personal data breach concerning Customer Data.

"Sub-Processor" means a third party which assists the Processor with the processing of Customer Data, or a third party which the Processor has subcontracted its processing operations under this DPA to.

1.4 Hierarchy

1.4.1 In the event of conflict between the Terms of Service and this DPA concerning the subject matter explicitly regulated herein, this DPA shall prevail.

1.4.2 In the event of conflict between the Annexes of the DPA and this DPA, this DPA shall prevail.

1.5 Scope

1.5.1 The Processor will process Customer Data on behalf of the Controller for the purpose of providing its services under the Terms of Service, and for the purpose of complying with its obligations under the Terms of Service.

1.5.2 The Service operates exclusively through test accounts created or designated by the Controller for the purpose of security testing. The Processor does not intentionally access, collect, or process personal data of the Controller's end-users or customers. If the Processor incidentally encounters such data during testing, whether because the data is visible to any authenticated user in the normal operation of the application or because a vulnerability permits access to data that should not be visible to the test account, the Processor shall employ reasonable measures to minimise the retention of personal data in Findings (see Section 2 for implementation timelines). While no anonymisation method is guaranteed to capture all personal data, the Processor commits to maintaining these measures as a reasonable technical safeguard in accordance with the principles of data minimisation and privacy by design (GDPR Articles 5(1)(c) and 25). Any personal data that remains in Findings despite these measures is subject to this DPA.

1.5.3 Annex I (Processing Details) to this DPA includes further information regarding the Processor's processing operations under this DPA, i.e. the subject matter, nature and purpose of the processing, as well as information regarding the categories of data subjects affected by the processing. For the avoidance of doubt, Annex I describes only the personal data that the Processor intentionally processes to deliver the Service, not personal data incidentally encountered as described in Section 1.5.2.

2. Implementation timelines

The Service is under active development. This Section sets out specific commitments that the Processor will implement within defined timeframes. "General availability" means the date the Service is made publicly available for sign-up without invitation, as announced by the Processor. The "pre-launch period" means the period prior to general availability of the Service.

2.1 Data minimisation in Findings

2.1.1 During the pre-launch period, the Processor shall employ reasonable measures to minimise the retention of personal data in Findings, including manual review where practicable.

2.1.2 Within 90 (ninety) days of the Service becoming generally available, the Processor shall implement automated anonymisation measures to remove or anonymise personal data before storing Findings, and shall maintain and improve such measures on an ongoing basis thereafter.

2.2 Sub-Processor change management

2.2.1 During the pre-launch period, the Processor may update the Sub-Processor list at its discretion by updating the list at the URL referenced in Section 7.1.

2.2.2 Within 90 (ninety) days of the Service becoming generally available, the Processor shall establish a notification-and-objection process for Sub-Processor changes. Under this process, the Processor shall notify the Controller at least 30 (thirty) calendar days prior to the engagement of a new Sub-Processor or a material change to an existing Sub-Processor's scope. If the Controller objects to a Sub-Processor change on reasonable data protection grounds, the Parties shall work in good faith to resolve the objection. If the Parties are unable to resolve the objection within 30 (thirty) calendar days, the Controller may terminate the Terms of Service and this DPA by written notice.

3. The Controller's instructions

3.1 Instructions

3.1.1 The Processor shall process Customer Data only on documented instructions from the Controller, unless otherwise required by a Member State law to which the Processor is subject. In this case, the Processor shall inform the Controller of that legal requirement before processing, unless the aforementioned law prohibits this on important grounds of public interest.

3.1.2 As of the effective date of this DPA, the Controller's processing instructions are set out in this DPA and the Terms of Service. The Controller may also issue processing instructions through the configuration and use of the Service. All such instructions shall be documented.

3.1.3 The Processor shall immediately inform the Controller if, in the Processor's opinion, instructions given by the Controller infringe Data Protection Law.

3.2 Purpose limitation

3.2.1 The Processor shall process the Customer Data only for the specific purpose(s) set out in this DPA, unless it receives further instructions from the Controller.

4. Security of processing

4.1 General security requirements

4.1.1 The Processor will, in accordance with GDPR Article 32, implement and maintain appropriate technical and organisational security measures to protect the Customer Data from accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and any other breach of security. The Processor shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, when implementing the above measures. Examples of such measures include:

• The pseudonymisation and encryption of Customer Data;

• The ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing Customer Data;

• The ability to restore the availability and access to Customer Data in a timely manner in the event of a physical or technical incident; and/or

• A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

4.1.2 The Processor shall furthermore implement and maintain the measures described in Annex III (Technical and Organisational Measures) to this DPA.

4.1.3 The Processor shall document the routines and measures the Processor has implemented in order to comply with its requirements under this Section 4.1. This documentation shall be available upon the Controller's request.

4.2 Personnel requirements

4.2.1 The Processor will ensure that the Customer Data is processed solely by reliable personnel who are:

• Familiar with Data Protection Law and the obligations imposed on the Processor under this DPA;

• Regularly trained in the care, protection and handling of personal data;

• Authorised to process the Customer Data only as necessary for the purpose set out in this DPA;

• Subject to a strict duty of confidentiality (whether a contractual or statutory duty); and

• Granted access to the Customer Data on a need-to-know basis.

5. Personal Data breach

5.1 Cooperation and assistance

5.1.1 Without prejudice to the Processor's obligations under Sections 5.2 to 5.3 below, the Processor shall cooperate with and assist the Controller with complying with its obligations under GDPR Articles 33 and 34. Furthermore, the Processor shall take all measures and actions necessary to remedy and mitigate the effects of a Personal Data Breach.

5.2 Personal Data Breach which the Controller is responsible for

5.2.1 In the event of a Personal Data Breach which the Controller is responsible for, the Processor shall upon request assist the Controller with:

• Notifying the Personal Data Breach to the competent supervisory authority/ies, without undue delay after the Controller has become aware of it, where relevant;

• Obtaining the following information which, pursuant to GDPR Article 33(3), shall be stated in the Controller's notification to the competent supervisory authority/ies:

  • the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

  • the likely consequences of the Personal Data Breach;

  • the measures taken or proposed to be taken by the Controller to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

• Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

• Complying with the Controller's obligation to communicate without undue delay the Personal Data Breach to the affected data subjects.

5.2.2 The Controller shall compensate the Processor for its reasonable and documented costs for performing its duties under this Section 5.2.

5.3 Personal Data Breach which the Processor is responsible for

5.3.1 In the event of a Personal Data Breach which the Processor is responsible for, the Processor shall notify the Controller without undue delay after the Processor becomes aware of the breach. Such notification shall contain, at least:

• A description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);

• The details of a contact point where more information concerning the Personal Data Breach can be obtained;

• Its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

5.3.2 Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

6. Sensitive data

6.1 The Processor does not intentionally process special category data (as defined in GDPR Article 9) or data relating to criminal convictions and offences (as defined in GDPR Article 10). If such data is incidentally encountered during testing, it is handled in accordance with Sections 1.5.2 and 2.1.

6.2 The anonymisation measures described in Section 2.1 remove direct identifiers but do not alter the underlying data content. Given that any exposure to special category data would be partial, incidental, and limited to what is necessary to demonstrate a vulnerability, the risk of indirect identification from such data is considered low. The measures set out in Sections 1.5.2 and 2.1, together with the security and retention obligations of this DPA, constitute appropriate safeguards for any such data.

7. Use of sub-processors

7.1 The current list of Sub-Processors authorised by the Controller is included in Annex II (List of Approved Sub-Processors) to this DPA and published at https://heisthq.com/sub-processors. For the avoidance of doubt, the list at the URL shall be the authoritative and up-to-date version.

7.2 The process for updating the Sub-Processor list is set out in Section 2.2 (Implementation Timelines).

7.3 Where the Processor engages a Sub-Processor for carrying out specific processing activities (on behalf of the Controller), it shall do so by way of a contract which imposes on the Sub-Processor, in substance, the same data protection obligations as the ones imposed on the data processor in this DPA. The Processor shall ensure that the Sub-Processor complies with the obligations to which the Processor is subject pursuant to this DPA and Data Protection Law.

7.4 At the Controller's request, the Processor shall provide a copy of such a Sub-Processor contract and any subsequent amendments, to the Controller. To the extent necessary to protect business secrets or other confidential information, including personal data, the Processor may redact the text of the contract prior to sharing the copy. The Processor shall notify the Controller of any failure by the Sub-Processor to fulfil its contractual obligations.

7.5 For the avoidance of doubt, the Processor's use of Sub-Processors does not exonerate or in any way reduce the Processor from any obligations and responsibilities under this DPA.

7.6 The Processor shall agree a third party beneficiary clause with the Sub-Processor whereby — in the event the Processor has factually disappeared, ceased to exist in law or has become insolvent — the Controller shall have the right to terminate the Sub-Processor contract and to instruct the Sub-Processor to erase or return Customer Data.

8. International transfers

8.1 The Processor shall not transfer Customer Data to countries outside the EEA ("Third Countries") or to an international organization, without the Controller's prior written consent. For clarity, remote access to Customer Data from a Third Country shall also be regarded as a transfer of Customer Data to a Third Country. If such consent is given, the Processor shall ensure that the transfer of Customer Data to the relevant Third Country or international organization complies with all conditions laid down in Chapter V of the GDPR.

8.2 The Processor shall document its compliance with this Section 8. This documentation shall comply with the guidelines and recommendations adopted by the European Data Protection Board and the Norwegian Data Protection Authority regarding Third Country personal data transfers. The documentation shall be available upon request of the Controller.

9. Assistance to the controller

9.1 The Processor shall promptly notify the Controller of any request it has received from a data subject concerning Customer Data. It shall not respond to the request itself, unless authorised to do so by the Controller.

9.2 The Processor shall assist the Controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing. The Processor shall comply with the Controller's instructions.

9.3 In addition to the Processor's obligation to assist the Controller pursuant to Section 9.2, the Processor shall assist the Controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the Processor:

• The obligation to carry out a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

• The obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Controller to mitigate the risk;

• The obligation to ensure that Customer Data is accurate and up to date, by informing the Controller without delay if the processor becomes aware that the Customer Data it is processing is inaccurate or has become outdated; and

• The Controller's obligations under GDPR Article 32.

10. Documentation, audits and inspections

10.1 The Processor shall be able to demonstrate its compliance with this DPA.

10.2 The Processor shall deal promptly and adequately with inquiries from the Controller about the processing of Customer Data under this DPA.

10.3 The Processor shall make available to the Controller all information necessary to demonstrate compliance with its obligations under this DPA. At the Controller's request, the Processor shall also permit and contribute to audits of the processing activities covered by this DPA, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the Controller may take into account relevant certifications held by the Processor.

10.4 The Controller shall provide at least 30 (thirty) calendar days' written notice prior to conducting an audit. The Controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the Processor. The Controller shall bear the costs of any audit, including the Processor's reasonable and documented costs of facilitating the audit.

10.5 Where the Processor holds a relevant, current third-party certification or audit report (such as SOC 2 or ISO 27001), the Processor may offer such certification or report to satisfy the Controller's audit request. The Controller shall accept such certification or report as sufficient unless the Controller has reasonable grounds to believe that the certification or report does not adequately address the Controller's audit concerns.

10.6 The Controller may make the information referred to in this Section 10, including the results of any audits, available to the competent supervisory authority/ies.

11. Data retention

11.1 The Processor shall handle retention and deletion of Customer Data in accordance with the Terms of Service (Sections 3.2 and 12.2 of the Terms of Service).

11.2 The above shall not prevent the Processor from complying with any EU/EEA law or Member State law which requires the Processor to continue to store the relevant Customer Data. Until the Customer Data is deleted, the Processor shall continue to comply with this DPA.

12. Term and termination

12.1 Term

12.1.1 This DPA is valid for as long as the Processor processes Customer Data on behalf of the Controller, regardless of whether or not the Terms of Service have been terminated.

12.2 Suspension

12.2.1 Without prejudice to any provisions of the GDPR, in the event that the Processor is in breach of its obligations under this DPA, the Controller may instruct the Processor to suspend the processing of Customer Data until the latter complies with this DPA or the Terms of Service are terminated. The Processor shall promptly inform the Controller in case it is unable to comply with this DPA, for whatever reason.

12.3 Termination for cause

12.3.1 The Controller shall be entitled to terminate the Terms of Service if:

• The processing of Customer Data by the Processor has been suspended by the Controller under Section 12.2 and if compliance with this DPA is not restored within a reasonable time and in any event within one month following suspension;

• The Processor is in substantial or persistent breach of this DPA or its obligations under Data Protection Law and has failed to remedy such breach within 14 (fourteen) calendar days of receiving written notice from the Controller specifying the breach;

• The Processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to this DPA or Data Protection Law (including courts or supervisory authority/ies which are competent vis-à-vis the Controller).

12.4 Consequences of termination

12.4.1 Following termination of the Terms of Service, the Processor shall handle Customer Data in accordance with Section 11 (Data Retention) of this DPA.

13. Liability

13.1 Each Party's liability arising under or in connection with this DPA is governed by the limitation of liability provisions in the Terms of Service (Section 10 of the Terms of Service).

13.2 The above limitations of liability shall not apply in the case of gross negligence or wilful misconduct on the part of a Party or anyone for whom that Party is responsible.

13.3 Notwithstanding the above, the Parties' liability for damage suffered by a data subject or other natural persons due to infringements of Data Protection Law shall be governed by GDPR Article 82.

14. Costs for complying with this DPA

14.1 Each Party is, unless otherwise explicitly set out herein, responsible for its own costs arising out of its compliance with this DPA.

14.2 The Controller shall compensate the Processor for the reasonable and documented costs which the Processor incurs in connection with:

• The assistance which the Processor provides, at the Controller's request, under Section 9.3 above; and

• The audits which the Controller carries out under Section 10 above.

15. Communications

15.1 All communications concerning this DPA shall be directed to the contact details set out below.

15.2 Communications to the Controller shall be sent to the email address associated with the Controller's account.

15.3 Communications to the Processor shall be sent to legal@heisthq.com.

16. Amendments

16.1 The Processor may update this DPA from time to time. Updates to this DPA follow the same process as amendments to the Terms of Service (see Section 14.4 of the Terms of Service).

17. Choice of law and legal venue

17.1 The rights and obligations of the Parties under this DPA shall in their entirety be governed by Norwegian law, without giving effect to the UN Convention on Contracts for the International Sale of Goods and any conflict of law principles.

17.2 Each Party irrevocably agrees to submit all disputes of whatever nature arising out of or in any way relating to this DPA (or any matters contemplated under this DPA) to the exclusive jurisdiction of Oslo District Court (Oslo tingrett).

Annex I – Processing Details

The below table includes further information regarding the processing activities carried out by the Processor on behalf of the Controller.

Annex II – List of Approved Sub-Processors

The current list of Sub-Processors is published and maintained at https://heisthq.com/sub-processors. The authoritative and up-to-date version of the Sub-Processor list is always the version at that URL.

Annex III – Technical and Organisational Measures

The Processor's technical and organisational security measures are described and maintained at the Processor's trust center: https://heisthq.com/trust. The authoritative and up-to-date version of the Processor's security measures is always the version published at that URL. The Processor may update these measures from time to time, provided that updates do not materially decrease overall security.