BackendX Data Processing Agreement

Effective Date: October 15th, 2026 Last Updated: October 15th, 2026 Contact: privacy@backendx.ai

This Data Processing Agreement ("DPA") forms part of the BackendX Terms of Use (the "Terms") between BackendX Inc. (주식회사 백엔드엑스) (the "Company") and the user identified in the account for the Service (the "User"). It contains the processor terms required by Article 28(3) of the GDPR and the consignment arrangement required by Article 26 of the Personal Information Protection Act of the Republic of Korea ("PIPA").

The Company presents this DPA for active acceptance when a generated service is deployed under Managed Hosting or Customer-Cloud (Company-Operated), on a per-project basis. Each acceptance is recorded with the document version, timestamp, accepting user, and the IP address from which acceptance was given (Terms Section 12.1), and — together with the deployment-questionnaire answers for that project (Section 4 below) — constitutes the data-processing agreement for that project. For the Company file storage (Terms Section 8.8), the Company presents this DPA in the same way when the User first enables it for a project, unless this DPA has already been accepted for that project.

---

1. Parties and Roles

• Controller (consignor / 위탁자): the User, as the controller of End-User Personal Data processed through the generated service.
• Processor (consignee / 수탁자): BackendX Inc. (주식회사 백엔드엑스), Representative Director DK Moon, with its registered office at Unit 9, 4th Floor, Business Building, 43 Changeop-ro, Sujeong-gu, Seongnam-si, Gyeonggi-do 13449, Republic of Korea, acting as processor on the User's behalf and in accordance with the User's documented instructions.

In the event of conflict between this DPA and the Terms or the Privacy Policy with respect to the processing of End-User Personal Data, this DPA controls.

2. Scope

1. This DPA governs End-User Personal Data: personal data of End Users of the User's generated service that the Company processes on the User's behalf in the course of a deployment through the Company, namely:
   • Managed Hosting — the full hosting and operation of the generated service described in Section 2.2 of the Terms;
   • Company file storage — regardless of the deployment option (including Self-Operated), storing and serving End Users' files, and their metadata, that a generated service stores in the Company file storage under Terms Section 8.8; and
   • Customer-Cloud (Company-Operated) — solely to the limited extent the Company processes End-User Personal Data in the course of error-event capture (Terms Section 10.3) and operational actions performed within the scope of the User's Access Token (Terms Section 11, including deployment, monitoring, scaling, and operational assistance in the Customer-Cloud), unless a separate operational delegation agreement between the parties provides otherwise.
2. This DPA does not govern:
   • Platform data — personal data of the User itself (account data, Requirements, interview conversations, payment records, questionnaire and acceptance records). For platform data the Company is the controller, and the Privacy Policy applies.
   • Self-Operated (Export) deployments — where the Company neither hosts, operates, accesses, nor processes the generated service or any End-User data (Terms Section 2.2). However, where such a generated service uses the Company file storage, this DPA applies to those files.
   • Sign-in account data — where "Sign in with BackendX" is connected to a generated service, the information in the sign-in accounts created by End Users. For that data the Company is the controller, and the BackendX Privacy Policy for Sign-in Users applies. However, where the generated service stores in its own database the service-specific identifier it receives from the Company, that stored identifier is End-User Personal Data governed by this DPA.

3. Definitions

Capitalized terms not defined here have the meaning given in the Terms; data-protection terms ("controller", "processor", "personal data", "processing", "personal-data breach") have the meaning given in the GDPR and PIPA.

• End User — a natural person who interacts with the generated service the User deploys (for example, the User's own customers or staff).
• End-User Personal Data — personal data of End Users that the Company processes on the User's behalf within the scope described in Section 2.1.
• Sub-processor — a third party engaged by the Company to process End-User Personal Data.

4. Description of Processing (Per Project)

The following description, completed per project by the User's deployment-questionnaire answers, constitutes the record of processing required by Article 28(3) of the GDPR and Article 26(1) of PIPA:

The deployment-questionnaire answers recorded for each project are incorporated into this DPA by reference as the project-specific annex to this Section.

5. Documented Instructions

1. The Company will process End-User Personal Data only on the User's documented instructions, which consist of: the Requirements and specification the User approved; the deployment configuration and questionnaire answers for the project; instructions given through the Service; and any further written instructions the Company accepts. The Terms and this DPA are themselves documented instructions.
2. If the Company considers that an instruction infringes the GDPR, PIPA, or other applicable data-protection law, it will inform the User without undue delay and may suspend execution of that instruction until it is confirmed or modified.

6. Controller Obligations of the User

In addition to the warranties given in Section 12.2 of the Terms, the User represents and warrants that:

1. it has, or will have before the generated service becomes available to End Users, a valid lawful basis under the GDPR (Articles 6 and, where applicable, 9), PIPA, and any other applicable law for each category of End-User Personal Data it causes the Company to process;

2. before making a generated service deployed through the Company available to End Users, it will publish a privacy policy applicable to that generated service (Terms Section 12.3), which, depending on the actual processing, will include at least the following:

   • that the User, as operator of the generated service, is the controller of End-User Personal Data;
   • that the Company acts as a processor performing hosting, deployment, operational assistance, error diagnostics (including error analysis and draft customer-support replies using third-party AI providers), security, and other tasks on the User's documented instructions;
   • where "Sign in with BackendX" is connected to the generated service, that the login account is operated by the Company as controller and that the generated service receives a service-specific identifier from the Company;
   • the categories or items of personal data that may be collected, used, stored, or transmitted from End Users;
   • the purpose of each processing activity;
   • the retention period of the personal data, or the criteria used to determine it;
   • where sub-processors, cross-border transfers, or third-party services used by the User exist, the matters required by applicable law; and
   • how End Users may exercise their rights and the contact point for privacy inquiries.

   The Company may provide notice language or a draft covering the personal-data items, processing purposes, retention periods, and the scope of the Company's processing as processor, based on the deployment questionnaire, the generated database schema, and the service configuration. The User must review such material and publish it as adapted to the actual operation of its service, and is responsible for adding any notices required for external payments, marketing, analytics, file storage, external login, or other processing activities specific to the User. The User must not remove notice language provided by the Company or narrow or misrepresent the actual scope of the Company's processing.

3. it has obtained, or will obtain before the generated service becomes available to End Users, any consents required from End Users; and

4. the generated service does not fall within a category listed in Section 8.2 or Section 8.3 of the Terms, and the personal-data categories declared in the deployment questionnaire are accurate and complete.

7. Processor Obligations of the Company

The Company will:

1. process End-User Personal Data only within the scope of the consigned work described in Section 4 and not for any other purpose, and not use it for training AI models of the Company or any third party, advertising, profiling, improving other Users' projects, or any independent commercial purpose (PIPA Article 26). The use of third-party AI providers for the error analysis and for preparing draft customer-support replies described in Section 4 falls within the scope of the consigned work, and the Company applies contracts and settings under which those AI providers do not use the transmitted content to train models;
2. ensure that persons authorized to process End-User Personal Data are bound by contractual or statutory obligations of confidentiality;
3. implement and maintain the technical and organizational measures described in Annex II;
4. engage Sub-processors only in accordance with Section 9, and not sub-consign the processing without the authorization described there (PIPA Article 26(6));
5. taking into account the nature of the processing, assist the User by appropriate technical and organizational measures in fulfilling the User's obligation to respond to End-User requests to exercise their rights (GDPR Chapter III; PIPA Articles 35–37), including by routing End-User rights requests received by the Company to the User's designated privacy contact (Terms Section 12.4);
6. assist the User in ensuring compliance with Articles 32 to 36 of the GDPR and the corresponding provisions of PIPA (security, breach notification, data-protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to the Company;
7. at the User's choice, delete or return all End-User Personal Data at the end of the provision of the Service for the project, as set out in Section 13; and
8. make available to the User the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits as set out in Section 14, and cooperate with the User's supervision of the consigned processing under PIPA Article 26(4).

8. Independent-Controller Carve-Out

Solely for the security, abuse-prevention, and legal-compliance processing described in Sections 10 and 8.8 of the Terms (including reactive inspection, automated inspection of files in the file storage and quarantine and reporting of violating files, evidence preservation, and responses to lawful demands), the Company acts as an independent controller to the narrow extent required. Except where this DPA does not apply under Section 2.2, all other processing of End-User Personal Data by the Company is performed as processor under this DPA. The scope, timing, and actors of any reactive inspection touching End-User Personal Data are recorded in an internal audit log (Terms Section 10.5).

9. Sub-processors

1. The User provides general written authorization for the Company to engage the Sub-processors listed in Annex I.
2. The Company will give at least 30 days' prior notice of any intended addition or replacement of a Sub-processor, by updating the Sub-processor list maintained on the Service and by notice to the User's designated privacy contact. However, where a Sub-processor must be replaced promptly because of a service discontinuation, a security incident or a legal requirement, the Company may give that notice before the replacement with a period shorter than 30 days, and only where notice before the replacement is not possible does it give the notice in the same manner without undue delay after the replacement. In either case the User may object under paragraph 3.
3. The User may object to a change on reasonable data-protection grounds. If the parties cannot resolve the objection before the change takes effect, the User may switch the affected project to a different Deployment Option or delete the project; fees are then handled in accordance with the Billing Policy and applicable law.
4. The Company will impose on each Sub-processor, by written contract (including a contract concluded in electronic form, such as data processing terms incorporated in the Sub-processor's online terms or accepted through the Company's account with the Sub-processor), data-protection obligations no less protective than those in this DPA, and remains fully liable to the User for the performance of its Sub-processors' obligations.

10. International Data Transfers

1. End-User Personal Data processed under Managed Hosting is stored in the Republic of Korea, currently in the AWS Asia Pacific (Seoul) region (ap-northeast-2). However, where the content of error events (request and response bodies and stack traces, after credential redaction) is sent to the third-party AI providers listed in Annex I for error analysis or for preparing draft customer-support replies, that information is transferred to the United States or the country in which the AI API is actually processed, and paragraphs 2 and 3 apply to that transfer. Where receipt confirmations and outcome emails are sent to persons who submit a report without signing in, their email address and the body of the email are likewise transferred to the United States through the email-delivery provider listed in Annex I, and paragraphs 2 and 3 apply to that transfer.
2. For End Users in the European Economic Area, transfers of personal data to the Company in the Republic of Korea are covered by the European Commission's adequacy decision for the Republic of Korea of 17 December 2021; for End Users in the United Kingdom, by the corresponding UK adequacy regulations. Where the Company makes an onward transfer to a country without an adequacy decision, the transfer is governed by the Standard Contractual Clauses (2021/914) or the UK International Data Transfer Addendum, as applicable, completed by reference to this DPA and its Annexes.
3. For cross-border transfers governed by PIPA, the Company complies with PIPA Articles 28-8 and 28-9, including the required disclosures and, where legally required, consent.
4. To the extent the CCPA/CPRA applies to End-User Personal Data, the Company acts as a "service provider": it will not sell or share such data, retain, use, or disclose it outside the business purpose described in Section 4 or the direct business relationship, or combine it with personal information from other sources except as permitted by CPRA regulations, and it certifies that it understands these restrictions. The Company will also comply with applicable obligations under the CCPA/CPRA and provide the same level of privacy protection as they require, notify the User if it determines that it can no longer meet those obligations, and cooperate with the User in responding to consumer requests; upon such notice, the User may take reasonable and appropriate steps to stop and remediate unauthorized use.

11. Security

The Company implements and maintains the technical and organizational measures described in Annex II, designed to ensure a level of security appropriate to the risk. The Company keeps the measures under review and may update them, provided the protection level is not materially reduced.

12. Personal-Data Breach Notification

1. The Company will notify the User of a personal-data breach affecting End-User Personal Data without undue delay, and in any case within seventy-two (72) hours of awareness (Terms Section 12.5), via the breach-response contact designated in the deployment questionnaire.
2. The notification will include, to the extent then known: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a point of contact.
3. The Company will provide reasonable assistance to enable the User to meet its own notification obligations (including the 72-hour supervisory-authority notification under GDPR Article 33, data-subject notification under GDPR Article 34, and the notification obligations under PIPA Article 34). The User is responsible for notifying supervisory authorities and End Users; the Company may notify End Users directly only where necessary to comply with a direct legal duty or where the User is unresponsive (Terms Section 12.5).

13. Return and Deletion

1. Before requesting deletion of a project, the User may export End-User Personal Data through the generated service's own interfaces and may request from the Company a copy of the project database (including, where the Company file storage is used, the stored files and their metadata); the Company will provide the copy in a structured, commonly used, machine-readable format within a reasonable period. Where the Company deletes a project under Section 2.5 of the Terms, the Company gives prior notice of the intended deletion in accordance with that Section, and the User may export the data or request a copy under this paragraph before the scheduled deletion date.
2. Upon deletion of the project (or removal of the deployment), the Company will delete End-User Personal Data as described in Section 3 of the Privacy Policy: access is deactivated immediately, and deployed instances are purged through asynchronous cleanup processes without undue delay. The project's dedicated database is removed from the operating environment without undue delay. So that a project the User deleted by mistake can be recovered, an archived copy of that database is kept in encrypted storage for 30 days after deletion and is then destroyed. The Company does not access the archived copy except to handle the User's recovery request. Encrypted error-event captures are rendered permanently unreadable by destruction of the project's encryption key after the 30-day retention period described above. Residual copies in backup media are deleted within the Company's backup-rotation cycle, not exceeding 90 days.
3. Files quarantined under Terms Section 8.8 are, notwithstanding the User's deletion instruction or the deletion of the project, kept encrypted and separated for the period set out in that Section and then destroyed. Deletion obligations do not apply to the extent retention is required by applicable law, in which case the Company will isolate and protect the retained data and delete it when the legal basis lapses. Upon request, the Company will confirm deletion in writing.

14. Audits and Information

1. The Company will make available to the User information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security assessments or certifications where available.
2. The User may conduct an audit (remote or on-site) no more than once per calendar year, with at least 30 days' written notice, during business hours, subject to confidentiality obligations, and in a manner that does not disrupt the Company's operations or compromise other Users' data or the multi-tenant environment. Audits triggered by a confirmed personal-data breach affecting the User's project, or by a supervisory authority's documented request, are not subject to the frequency limit.
3. The parties will agree in good faith on scope, confidentiality, and reasonable cost allocation before the audit. Nothing in this Section limits a supervisory authority's statutory powers or the User's supervision rights under PIPA Article 26(4).

15. Liability and Indemnity

1. The parties' liability under this DPA is governed by Section 17 of the Terms, except that nothing in this DPA limits either party's liability to the extent such limitation is prohibited by Article 82 of the GDPR, PIPA, or other applicable mandatory law.
2. The customer indemnity in Section 12.6 of the Terms applies to claims arising from the User's breach of its obligations under this DPA, including the absence of a lawful basis or required consents and the failure to deliver a compliant End-User privacy policy.
3. Where the Company is liable to an End User or fined by an authority due to processing performed on the User's unlawful instruction or the User's breach of this DPA, the User will compensate the Company to the extent attributable to the User; where the User suffers damage due to the Company's breach of this DPA, PIPA Article 26 and applicable law govern the Company's liability for the consigned processing.

16. Term

This DPA takes effect for a project when the User accepts it at deployment of that project or when first enabling the Company file storage for it and remains in effect for as long as the Company processes End-User Personal Data for that project. Sections 13 to 15 survive termination. If the Company materially revises this DPA, the revised version applies to a project upon the User's re-acceptance at that project's next deployment or regeneration. However, where a material revision of this DPA is announced together with an amendment of the Terms and the User consents to the amended Terms under Section 18 of the Terms, the revised DPA applies to all of the User's projects from the effective date of that revision. Non-material updates (such as Annex I changes made under Section 9) are effective upon the notice described there.

17. Governing Law and Jurisdiction

This DPA is governed by, and disputes are resolved in accordance with, Section 19 of the Terms, except that mandatory data-protection law applicable to a transfer mechanism referenced in Section 10 governs to the extent it so requires.

---

Annex I — Sub-processors

The payment processors and source-code hosts listed in Section 5 of the Privacy Policy process platform data (the User's own data) as consignees of the Company and are not Sub-processors of End-User Personal Data; payment processing concerns the User's subscription, not End-User payments. Because the Company does not copy the content of error events included in a draft reply into the reply email (Annex II), the providers the Company uses to send replies and to store Company email (Section 5 of the Privacy Policy) do not process End-User Personal Data in connection with replies; of these, ActiveCampaign, LLC (Postmark) is a Sub-processor only for sending the reporter emails listed in the table above. Third-party AI providers process platform data when generating the service from the User's Requirements and in the automated analysis of those Requirements, and are Sub-processors of End-User Personal Data only for the error analysis and draft replies listed in the table above. The Company does not use AI providers in the deployed service's own handling of End-User requests. The current Sub-processor list is maintained on the Service.

Annex II — Technical and Organizational Measures

1. Tenant isolation — projects are isolated at the application, network, and database level on shared multi-tenant infrastructure, including a dedicated database and a dedicated, least-privilege database role per project; per-project database credentials are derived and managed through a key-management service.
2. Encryption — TLS 1.2 or higher in transit on all external interfaces; encryption at rest for databases and storage using cloud-provider managed encryption with KMS-managed keys; error-event captures are credential-redacted at capture time and envelope-encrypted with a per-project key before leaving the generated service, and are decrypted only (i) to present incident details to authorized project members, (ii) for analysis of the cause of errors and generation of proposed fixes, (iii) where the Company provides customer support to resolve the User's incidents, or (iv) in the reactive-inspection cases described in Section 10 of the Terms.
3. Access control — role-based access on the principle of least privilege; multi-factor authentication for privileged administrative access; access revoked promptly on personnel changes.
4. Audit logging — administrative access to End-User Personal Data in the course of customer support or reactive inspection, and the transmission of End-User Personal Data to AI providers for draft customer-support replies (which takes place only where the person requesting support is authorized to view that project's error events), are recorded (scope, timing, actors) in an internal audit log.
5. Backup and recovery — encrypted automated backups of project databases and a procedure for restoring from them.
6. Vulnerability management — vulnerability checks of dependencies and hosts; patching of the managed runtime environment.
7. Personnel — confidentiality obligations in employment or engagement contracts; security and privacy training.
8. Data minimization at the AI boundary — deterministic redaction of credentials before text leaves the Company's perimeter to an AI provider; End-User Personal Data passed to AI providers is limited to the error events needed for the error analysis and draft replies listed in Annex I and to files subject to the automated inspection under Terms Section 8.8.
9. Incident response — incident-response procedures, including the 72-hour customer notification in Section 12 and evidence preservation.
10. Sub-processor management — written data-protection contracts and review on onboarding.
11. Minimization in reply emails — the Company does not copy the content of error events included in a draft reply into the reply email sent to the User.