attachmentAV Data Processing Agreement

Version 1.0 – Effective 12 November 2026

Part 1 – Incorporation of the Standard Contractual Clauses

1.1 Parties. This Data Processing Agreement (“DPA”) is entered into between widdix GmbH, Blumenstraße 17/1, 73669 Lichtenwald, Germany (“widdix”, acting as processor) and the Customer identified in the Order (“Customer”, acting as controller). It forms part of the attachmentAV Customer Terms (the “Terms”) in accordance with Section 6.4 of the Terms. Capitalised terms not defined in this DPA have the meaning given in the Terms.

1.2 Incorporation. The Parties hereby enter into the Standard Contractual Clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 and Article 29(7) of Regulation (EU) 2018/1725, as set out in the Annex to Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (the “Clauses”). The Clauses are incorporated into this DPA by reference in the version published in the Official Journal of the European Union (OJ L 199, 7.6.2021, p. 18), available at https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj. The processor will provide a copy of the Clauses on request.

1.3 Selections. The Parties make the following selections in the Clauses:

1. Clause 1(a) and Clause 8(c)(4): OPTION 1 applies. The Clauses ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 (GDPR). OPTION 2 (Regulation (EU) 2018/1725) does not apply, unless Customer is a Union institution, body, office or agency, in which case OPTION 2 applies.
2. Clause 5 (Docking clause): does not apply.
3. Clause 7.7(a) (Use of sub-processors): OPTION 2 (GENERAL WRITTEN AUTHORISATION) applies. The processor has the controller’s general authorisation for the engagement of sub-processors from the agreed list in Annex IV. The time period for prior notice of intended changes to that list is 30 days.
4. Clause 9 (Notification of personal data breach): The Parties agree that a notification under Clause 9.2 will be made within the time period stated in Part 3, Section 3.4.
5. Clause 10(c) (Termination; deletion or return): Because scanned files are deleted immediately after each scan and are not retained by the processor, the “deletion” option applies to any remaining personal data at the end of the provision of the services, subject to Part 3, Section 3.6.

1.4 Electronic conclusion. The Parties agree that this DPA, including the Clauses, is concluded in electronic form within the meaning of Article 28(9) GDPR upon Acceptance of the Terms. No separate signature is required. Annex I is completed by the identification of Customer in the Order and in Customer’s account.

1.5 Hierarchy. In accordance with Clause 4, the Clauses prevail over any conflicting provision of the Terms and of this DPA. Part 3 of this DPA contains additional provisions within the meaning of Clause 2(b), which supplement the Clauses and do not contradict them or prejudice the fundamental rights or freedoms of data subjects.

1.6 Scope. This DPA applies to the extent widdix processes personal data contained in Customer Data on behalf of Customer in providing the Products. It applies irrespective of where Customer is established and of the processing region selected by Customer; for Customers subject to the UK GDPR or the Swiss Federal Act on Data Protection, Part 3, Section 3.7(c) and (d) apply. It does not apply to attachmentAV Self-Hosted on AWS (Section A.7 of the Terms), except where widdix accesses Customer Data in the course of support services requested by Customer. Where Customer itself acts as a processor for a third-party controller, Customer confirms that it is authorised to engage widdix as a sub-processor on the terms of this DPA, and references to “controller” are to be read accordingly.

Part 2 – Annexes to the Clauses

ANNEX I – List of Parties

Controller(s):

Name: Customer, as identified in the Order. Address: as stated in the Order or Customer’s account. Contact person’s name, position and contact details: as designated in Customer’s account (see Part 3, Section 3.8). Signature and accession date: Acceptance of the Terms in accordance with Section 1.1 of the Terms; date of Acceptance.

Processor(s):

Name: widdix GmbH Address: Blumenstraße 17/1, 73669 Lichtenwald, Germany Contact person’s name, position and contact details: Andreas Wittig, Managing Director; hello@attachmentav.com

Signature and accession date: by publication of this DPA as part of the Terms; effective on Customer’s Acceptance.

ANNEX II – Description of the Processing

Categories of data subjects whose personal data is processed

Determined by the controller through the files it submits for scanning. The categories may include the controller’s employees, contractors, customers, prospects, suppliers, users of the controller’s services or Platforms, and any other individuals whose personal data is contained in files uploaded to the controller’s systems or Platforms.

Categories of personal data processed

1. Personal data contained in files submitted for scanning: determined by the controller; may include any category of personal data (e.g. identification and contact data, communication content, documents, HR data, financial data, health data, data relating to children, customer data).
2. Scan metadata generated by the Products: scan requests (file references such as download URLs and callback URLs, trace ID, request metadata); scan results (trace ID, status, finding, file size and type); failed callback deliveries (callback URL, file reference, request metadata, time, error code, error response); access logs (IP address, time, requested API endpoint, user agent, path); application logs (technical events, scan outcome; no file contents and no file URLs); account data (subscription, plan, API keys, usage counters).

Sensitive data processed (if applicable) and applied restrictions or safeguards

Files submitted for scanning may contain special categories of personal data within the meaning of Article 9 GDPR (such as health data), personal data of children, data relating to criminal convictions and offences (Article 10 GDPR) or data subject to professional secrecy, as determined by the controller. The processor does not inspect or evaluate file content beyond the automated malware analysis. Applied restrictions and safeguards: strict purpose limitation to malware detection; encryption in transit and at rest; transient storage limited to the duration of the scan; automatic deletion of the file immediately after the scan; no human access to file content; access to scan metadata restricted to authorised personnel on a need-to-know basis. The controller is responsible for assessing whether these safeguards are sufficient for the sensitive data it submits (see Part 3, Section 3.2).

Nature of the processing

Receipt of files (or references to files) from the controller or from a Platform on the controller’s behalf; transient encrypted storage; automated analysis for malware by a commercial anti-malware engine; transmission of a cryptographic hash of the file to the engine vendor’s threat-intelligence service for reputation lookup (no file content); generation and return of the scan result; execution of actions configured by the controller (e.g. tagging, notification, deletion in the Platform); deletion of the file; storage of scan metadata; provision of support.

Purpose(s) for which the personal data is processed on behalf of the controller

Detection of malware in files processed in the controller’s systems and Platforms, and provision of the attachmentAV Products as described in the Terms and the Documentation.

Duration of the processing

For the Subscription Term and until deletion in accordance with Clause 10(c) and Part 3, Section 3.6. Individual files are processed for the duration of the scan only (seconds to minutes).

For processing by (sub-)processors, also specify subject matter, nature and duration of the processing

See Annex IV. Hosting provider: operation of the infrastructure on which all of the above processing takes place, for the duration of the processing. Engine vendor: hash-based reputation lookup at the time of each scan.

ANNEX III – Technical and Organisational Measures including Technical and Organisational Measures to Ensure the Security of the Data

Measures of pseudonymisation and encryption of personal data: Encryption in transit (TLS 1.2 or higher) for all connections to and from the Products; encryption at rest of transient file storage, databases and backups using managed keys (such as AWS KMS) where applicable; storage of file hashes rather than file content in scan metadata.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services: Redundant deployment across multiple AWS availability zones in the processing region; automated scaling; infrastructure as code; monitoring and alerting; DDoS protection by the hosting provider; separation of production, staging and development environments; logical separation of customer data by account, API key and Platform instance.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident: Daily backups of configuration, account and metadata stores with 35 days’ retention; documented restore procedure, tested annually. Scanned files are not stored persistently and are therefore not backed up.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing: Information security management system certified under ISO/IEC 27001 (certificate no. IC-IS-2503268, issued by InterCert; current certificate available on request); annual internal audits and management review; automated vulnerability and dependency scanning; patching of critical vulnerabilities within 3 days; external penetration tests annually.

Measures for user identification and authorisation: Role-based access via AWS IAM with least-privilege policies; multi-factor authentication for all administrative access; named accounts, no shared credentials; periodic access reviews; API authentication by keys or tokens.

Measures for the protection of data during transmission: TLS 1.2 or higher; signed requests where supported by the Platform; no transmission of file content to third parties.

Measures for the protection of data during storage: Encryption at rest; transient storage of files limited to the duration of the scan; automatic deletion after scan; no interactive access to scanned files by personnel.

Measures for ensuring physical security of locations at which personal data are processed: Processing takes place exclusively in data centres of the hosting provider (AWS), whose physical security controls are certified under ISO/IEC 27001, SOC 2 and other standards. The processor’s personnel have no physical access to the data centres.

Measures for ensuring events logging: Logging of scan requests, results and actions with timestamp and originating account; logging of administrative access; logs protected against alteration.

Measures for ensuring system configuration, including default configuration: Infrastructure as code with version control and peer review; hardened base images.

Measures for internal IT and IT security governance and management: ISMS under ISO/IEC 27001; information security policy; defined roles and responsibilities; risk management process; incident response procedure with escalation paths.

Measures for certification/assurance of processes and products: ISO/IEC 27001 certificate; hosting provider certifications (ISO 27001, SOC 1/2/3, C5).

Measures for ensuring data minimisation: No retention of file content; scan metadata limited to what is necessary for operation, support, billing and security; retention periods in Part 3, Section 3.6.

Measures for ensuring data quality: Not applicable to file content (not altered by the processor); integrity of scan metadata ensured by logging and access controls.

Measures for ensuring limited data retention: Automatic deletion of files after scan; automated deletion or anonymisation of scan metadata after the retention period.

Measures for ensuring accountability: Record of processing activities (Article 30(2) GDPR); sub-processor due diligence and contracts; data protection training of personnel on joining and annually; confidentiality obligations of personnel.

Measures for allowing data portability and ensuring erasure: Export of scan logs in the format offered by the Product; deletion of account data and scan metadata on request and at the end of the Subscription Term in accordance with Part 3, Section 3.6.

For transfers to (sub-)processors, also describe the specific technical and organisational measures to be taken by the (sub-)processor to be able to provide assistance to the controller: The hosting provider provides its security documentation and certifications and supports the processor in incident response. The engine vendor receives file hashes only and holds no personal data enabling assistance; assistance is therefore provided by the processor directly.

ANNEX IV – List of Sub-processors

The controller has authorised the use of the following sub-processors (Clause 7.7(a), OPTION 2):

Part 3 – Additional Provisions (Clause 2(b))

The following provisions supplement the Clauses. They apply only to the extent they do not contradict the Clauses or prejudice the fundamental rights or freedoms of data subjects.

3.1 Instructions (Clause 7.1). The controller’s documented instructions consist of the Terms, this DPA, the controller’s configuration of the Products (including the selection of scan scopes and actions) and the controller’s use of the Products in accordance with the Documentation. Additional instructions that go beyond the functionality of the Products require agreement in text form and may be subject to additional fees where they cause additional effort for the processor.

3.2 Sensitive data (Clause 7.5). Because the processor does not inspect file content, it cannot apply restrictions that depend on the content of individual files. The controller is responsible for assessing, before submitting files containing sensitive data, whether the safeguards described in Annex II and Annex III are appropriate, and for obtaining any consents or releases required for the processing of such data by the processor.

3.3 Sub-processors (Clause 7.7). The processor will give the notice under Clause 7.7(a), OPTION 2, by updating the list published at https://attachmentav.com/subprocessors and by notifying the controller by email to the address associated with the controller’s account or through the Product. The controller may object on reasonable, documented grounds relating to data protection within 14 days of the notice. If the controller objects and the Parties do not agree on a solution within 30 days, either Party may terminate the affected Subscription with effect from the date on which the new sub-processor would begin processing; the processor will refund prepaid, unused Fees for the affected Subscription. Copies of sub-processor agreements under Clause 7.7(c) may be redacted to remove commercial information and may be provided in summary form where the sub-processor’s terms are publicly available.

3.4 Personal data breach (Clause 9.2). The processor will notify the controller of a personal data breach concerning data processed by the processor without undue delay and in any event within 48 hours after becoming aware of it, by email to the controller’s designated contact. Information not available at the time of the first notification will be provided in phases without undue further delay. The processor will not notify supervisory authorities or data subjects on the controller’s behalf unless required by law or instructed by the controller.

3.5 Audits and assistance (Clauses 7.6 and 8).

1. The processor will make available the information necessary to demonstrate compliance primarily by providing its current ISO/IEC 27001 certificate and statement of applicability (or a summary), the measures in Annex III, its security documentation, summaries of relevant third-party audit reports, and written responses to reasonable questionnaires no more than once per year, unless a personal data breach or a supervisory authority requires otherwise.
2. Audits and inspections under Clause 7.6(d) will be conducted (i) with at least 30 days’ prior notice in text form stating scope and purpose, except where a supervisory authority or a personal data breach requires a shorter period; (ii) during the processor’s normal business hours and without unreasonable disruption of its operations; (iii) by the controller or an independent auditor mandated by the controller, bound by confidentiality and not a competitor of the processor; (iv) in the first instance remotely (document review, interviews, screen sharing); on-site inspections of the hosting provider’s data centres are replaced by the hosting provider’s certifications and audit reports.
3. The controller bears its own costs of audits and inspections. The processor may charge reasonable fees at its then-current rates for supporting on-site audits and for assistance under Clause 8 that goes beyond the provision of its standard documentation, unless the audit reveals a material breach of this DPA by the processor.

3.6 Deletion and retention (Clause 10(c)). Files submitted for scanning are deleted automatically immediately after the scan result has been produced. Data generated by the Products is deleted no later than the following periods after its creation: scan requests 14 days, scan results 24 hours, failed callback deliveries 30 days, access logs and application logs 90 days. Account data is deleted no later than 90 days after the end of the Subscription Term, and personal data contained in system backups (which do not contain scanned files) no later than 35 days after its deletion from the production systems, in each case unless Union or Member State law requires longer storage. Before the end of the Subscription Term, the controller may export scan logs in the format offered by the Product. Upon request in text form, the processor will confirm deletion in writing.

3.7 International transfers (Clause 7.8).

1. The processor processes personal data in the European Union (AWS region eu-west-1, Ireland), unless the controller selects another processing region offered for the respective Product. The selection of a processing region outside the European Economic Area constitutes the controller’s documented instruction within the meaning of Clause 7.8(a) to transfer personal data to that region; the transfer to the hosting provider in that region is based on the transfer mechanism stated in Annex IV. Other transfers to third countries take place only to sub-processors listed in Annex IV on the basis of the transfer mechanism stated there, or on the controller’s documented instruction.
2. Where the controller is established outside the European Economic Area and the transmission of personal data by the processor to the controller (such as the return of scan results or the provision of support) constitutes a transfer under Chapter V GDPR, the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914, MODULE FOUR (transfer processor to controller), are incorporated into this DPA with the following selections: Clause 7 (docking) does not apply; Clause 11(a) optional language does not apply; Clause 17: laws of Germany; Clause 18: courts of Germany; Annex I.A and I.B are completed with Annex I and Annex II of this DPA, with the processor as data exporter and the controller as data importer.
3. Where the UK GDPR applies, references to the GDPR include the UK GDPR and the Data Protection Act 2018; for transfers subject to UK law, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) is incorporated, with Tables 1 to 3 completed with the information in this DPA and Table 4 selecting “neither party”.
4. Where the Swiss Federal Act on Data Protection applies, references to the GDPR include that Act; the Federal Data Protection and Information Commissioner is the competent supervisory authority; references to “Member State” in the standard contractual clauses include Switzerland; and data subjects in Switzerland may enforce their rights in Switzerland.

3.8 Contacts. The controller will designate a contact for data protection matters in its account and keep it up to date. The processor’s contact for data protection matters is hello@attachmentav.com.

3.9 United States state privacy laws. To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, or a comparable US state privacy law applies: the processor acts as a “service provider” or “processor” and the controller as a “business” or “controller”; the processor will not sell or share personal data, will not retain, use or disclose personal data for any purpose other than the business purposes specified in this DPA and the Terms or outside the direct business relationship with the controller, and will not combine personal data with personal information received from other sources except as permitted by that law; the processor will comply with the obligations applicable to service providers under that law and provide the same level of privacy protection as required of businesses; the processor will notify the controller if it determines that it can no longer meet those obligations; and the controller may take reasonable and appropriate steps under Section 3.5 to ensure compliant use and to stop and remediate unauthorised use.

3.10 Other jurisdictions. Where data protection laws of other jurisdictions (such as Australia, Canada or India) apply to the controller’s use of the Products, the Parties agree that the Clauses and this DPA are intended to satisfy the requirements for the engagement of a processor or service provider under those laws to the extent they are comparable, and will cooperate in good faith to agree on any additional terms that are mandatorily required.

3.11 Liability. The Clauses do not govern the liability of the Parties towards each other. The liability of the Parties under or in connection with this DPA, including the Clauses, is governed by Section 11 of the Terms. The Parties’ liability towards data subjects under Article 82 GDPR remains unaffected; as between the Parties, each Party is liable for the share of the damage attributable to its own breach, in accordance with Article 82(5) GDPR.

3.12 Changes. The processor may update Part 2 and Part 3 of this DPA in accordance with Section 14 of the Terms, in particular to reflect changes in applicable data protection law, new standard contractual clauses or guidance from supervisory authorities, provided that the level of protection for personal data is not reduced. The Clauses themselves are not modified (Clause 2(a)); where the European Commission adopts amended or replacement standard contractual clauses under Article 28(7) GDPR, the processor may refer to the amended or replacement clauses accordingly with notice to the controller.

3.13 Governing law. This DPA is governed by the laws of the Federal Republic of Germany, without prejudice to mandatory provisions of applicable data protection law and to the governing-law provisions of the standard contractual clauses incorporated under Section 3.7.

Appendix 1 – Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/915)

The Clauses are available at https://eur-lex.europa.eu/eli/dec_impl/2021/915/oj. The processor will provide a copy on request.