Scope and Purpose of Personal Data Processing

Subject Matter, Nature, and Purpose	Processing is performed for the purpose of providing the Service to the Client based on the Main Agreement and to fulfill Vercom's obligations arising from this Data Processing Agreement, particularly regarding data security, including ensuring its integrity and availability.
Duration of Processing	The data processing period shall be the same as the period of Service provision under the Main Agreement, with the proviso that the Data Processing Agreement remains in force until the data is deleted in accordance with its provisions.
Categories of Data Subjects	The processed personal data concerns the following categories of natural persons: End users – natural persons who are recipients of electronic communication sent by the Client under the Main Agreement.
Types of Special Categories of Personal Data	The processed special categories of personal data include the following categories: Not Applicable.
Approved Sub-processors	In order to provide services, Vercom cooperates with domestic telecommunications operators (in the case of domestic SMS dispatch) and foreign SMS service providers (in the case of SMS dispatch abroad).

Detailed List of Main Processors (Sub-processors)

Entity	Scope of Entrustment	Processing Area
Beyond Solutions sp. z o.o., Poland Adama Kręglewskiego 11, 61-248 Poznań, Poland	Server rooms and Data center (colocation, backup)	EEA
NTT Global Data Centers EMEA GmbH Voltastraße 15, 65795 Hattersheim, Germany	Server rooms and Data center (colocation, backup)	EEA
Cyber Folks S.A. Wierzbięcice 1B, 61-569 Poznań, Poland	Hosting services	EEA
Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, LU-1855 Luxemburg, R.C.S., Luxemburg: B186284	Data backup	EEA
Cloudflare, Inc. 101 Townsend St, San Francisco, CA 94107, USA	Provider of solutions enhancing the security of provided services (WAF service)	EEA1

¹The service provided by Cloudflare, Inc. ("Cloudflare") to Vercom S.A. ("Vercom") includes WAF (i.e., Web Application Firewall). Enriching Vercom services with WAF aims to increase the security of services provided by Vercom to the Company's Clients.

Vercom has ensured adequate contractual provisions guaranteeing, inter alia:

a) inclusion of the Data Localisation Suite (DLS) option in the WAF service – thanks to DLS, information processed by Vercom as part of the services provided by Vercom remains within the European Union;

b) inclusion of the EU Customer Metadata Boundary option in the WAF service – thanks to which data processed by Vercom on behalf of Vercom's Clients will not be transferred outside the European Union.