Draft for legal review. These terms are not in effect yet.

Data Processing Agreement

Effective [EFFECTIVE DATE] · Version 2026-10-16

This Data Processing Agreement (the "DPA") is part of the Terms of Service between you, the Owner, and Konnectia USA LLC, a Delaware limited liability company that provides the Basemodo service ("Basemodo", "we", "us"). It applies whenever Basemodo processes Customer Personal Data on your behalf, and it takes effect when you accept the Terms, with no separate signature. Words with capitals mean what the Terms define.

For Customer Personal Data, you are the controller (a "business" under the California Consumer Privacy Act, the "responsable" under Colombian law) and Basemodo is your processor (a "service provider", the "encargado"). For the data about your own account, Basemodo is the controller, and thePrivacy Policy applies instead.

1. Definitions

• Customer Personal Data: personal data in Your Content that Basemodo processes for you to run your Apps: what your Apps collect and store (their data, files and Database), their Logs and Backups, and the identity of each signed-in Visitor that Basemodo passes to your App (their email address, their id and their role).
• Data Protection Law: every law on privacy and personal data that applies to the processing of Customer Personal Data, such as the California Consumer Privacy Act and other U.S. state privacy laws, Colombia's Law 1581 of 2012, and, where they apply, the EU and UK General Data Protection Regulations and the Swiss Federal Act on Data Protection.
• Security Incident: a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor: a company Basemodo engages that processes Customer Personal Data for us.

2. The processing

• Subject and purpose: building, running, storing, backing up, serving and deleting your Apps, as the Terms describe, and nothing else.
• Nature: storage, computation, transmission, backup and deletion, mostly by automated systems.
• Duration: while the Terms are in effect between us, and until the data is deleted under Section 9.
• Data subjects: your Visitors, Members and Editors, and anyone else whose personal data your Apps process.
• Types of data: whatever your Apps collect, which you decide, and the Visitor identity above. Under the Terms, you do not use the Service for payment card numbers, health records regulated by HIPAA or other data with special legal requirements unless we agreed in writing.

3. Your instructions

Basemodo processes Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and what you or your Agents and Editors do through the Service: deploying, configuring, sharing, running commands, restoring and deleting. We process it otherwise only when a law we are subject to requires it, and we then tell you first, unless that law forbids it. If we believe an instruction breaks Data Protection Law, we tell you, and may refuse to follow it until you confirm or change it.

We do not look at the content of your Apps, except to provide the Service, to keep it secure and stop abuse (as the Acceptable Use Policy describes), to help you when you ask, or to comply with the law.

4. Confidentiality

Only the people at Basemodo who need it to run, secure and support the Service may access Customer Personal Data, and each is bound by a duty of confidentiality. Every action an Operator takes on an account or an App is recorded.

5. Security

Basemodo keeps technical and organizational measures appropriate to the risk, and improves them over time without lowering the protection they give. Today they include:

• every App in a virtual machine of its own, with no network between Apps and no route from an App to Basemodo;
• encryption in transit to basemodo.com, to the API and to every App;
• Secrets encrypted by Basemodo before they are stored and given only to the App they belong to; Apps' volumes encrypted at rest;
• identity passed to an App in headers that a request cannot forge, with a token signed with that App's own key;
• the servers where Apps run reachable only by our control plane, with every request to them signed, and staff access to them only over a private network, with keys, every session logged;
• daily Backups of every App, and the monitoring of abuse the Acceptable Use Policy describes.

You are responsible for the security of your Apps' own code, of the Secrets you give them, of who you let reach them, and of your account.

6. Subprocessors

You give Basemodo a general authorization to engage Subprocessors. The ones we use today are listed, with what each does and its country, on the Subprocessors page. Before a new Subprocessor processes Customer Personal Data, we update that page and email you at least 30 days ahead; you may object as that page describes, and if we cannot resolve your objection you may end your Plan before the change applies to you, with a refund of what you prepaid for the time after it. We hold each Subprocessor, by written contract, to data protection obligations at least as protective as this DPA, and we remain responsible to you for its performance of them as Data Protection Law requires.

Link, operated by Stripe, sells you your Plan as the merchant of record, and Konnectia USA LLC provides the Service. Link processes your billing information as an independent controller, under its own privacy policy, and processes no Customer Personal Data.

7. Helping you meet your obligations

• Requests from people. If a Visitor or anyone else asks Basemodo to access, correct, delete or receive their data in your App, or to stop its processing, we will not answer it ourselves beyond sending them to you, and we will tell you. You can answer such requests with the Service itself: you can read, change and delete your Apps' data (with your App, basemodo db and basemodo run), download it, and delete an App. Where that is not enough, we help you as far as is reasonable.
• Assessments. We give you the information about the Service you reasonably need for a data protection impact assessment, or to consult a supervisory authority, taking into account the nature of the processing and the information available to us.

8. Security Incidents

We notify you without undue delay after we become aware of a Security Incident, by email to your account's address (for a Workspace, to its Admins). The notice says, as far as we know them at the time, what happened, the categories and approximate number of people and records concerned, its likely consequences, and what we have done or propose to do; we send what we learn later as we learn it. We take reasonable steps to contain the incident and limit its harm. Notifying you is not an admission of fault. You decide whether to notify authorities or the people concerned, and we help you as Section 7 describes.

9. Return and deletion

You can download an App's data while your account is active and for the 30 days after your Plan ends, except while the App is held for a Review or its Owner is Suspended. When your Plan ends, your Apps are paused and their data is kept for those 30 days; after them, we may delete it at any time. When you delete an App, its data is deleted when its last Backup expires. When you ask us to delete your account, atprivacy@basemodo.com, we delete Customer Personal Data within 30 days. Copies in Backups and logs are deleted when they expire, within the retention your Plan shows. We keep Customer Personal Data longer only where a law requires us to, and then only for that purpose.

10. Information and audits

We make available to you the information reasonably needed to show that we meet this DPA: this DPA, the description of our security above, and our written answers, once a year, to a reasonable security questionnaire. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance once a year, on 30 days' written notice, at your cost, during business hours and without access to other customers' data or to anything that would compromise the security of the Service. Audits of our Subprocessors are covered by the reports and certifications they make available.

11. International transfers

Basemodo and its Subprocessors process Customer Personal Data in the United States, and Basemodo's team reaches it from Colombia. Plans are not offered to residents of the European Economic Area, the United Kingdom or Switzerland, and the Service is not directed to them. If Data Protection Law nonetheless requires a transfer mechanism for Customer Personal Data that an App receives from those places, the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two, controller to processor) are incorporated into this DPA by reference, with you as data exporter and Basemodo as data importer, and with these choices: Clause 7 is not used; under Clause 9, Option 2 applies with the notice of Section 6; Clause 11's optional wording is not used; Clauses 17 and 18 choose the law and the courts of Ireland; and their Annexes are completed by Section 2 (Annex I), Section 5 (Annex II) and the Subprocessors page (Annex III). For the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those Clauses, and for Switzerland they apply with the Swiss Federal Act on Data Protection in place of the GDPR where it governs the transfer.

12. California

Where Customer Personal Data is personal information under the California Consumer Privacy Act, Basemodo is your service provider, and:

• we do not sell or share it, and do not use it for cross-context behavioral advertising;
• we do not retain, use or disclose it for any purpose other than providing the Service under the Terms, or outside our direct business relationship with you, except as the Act allows a service provider to;
• we do not combine it with personal information we receive from anyone else, or collect ourselves, except as the Act allows;
• we comply with the Act and give it the same level of privacy protection the Act requires of you, and tell you if we can no longer meet these obligations;
• you may take reasonable and appropriate steps to make sure we use it in a manner consistent with your obligations under the Act, and to stop and remediate any use you did not authorize, after telling us.

We certify that we understand these restrictions and will comply with them.

13. Colombia

For Customer Personal Data that Colombia's Law 1581 of 2012 governs, this DPA is the contract of transmission between you, as the responsable, and Basemodo, as the encargado, that Colombian law requires: Basemodo processes it only as Section 3 says, keeps it secure and confidential as Sections 4 and 5 say, and follows the data protection policy you give your Visitors when you tell us about it. You are responsible for having your Visitors' authorization where that law requires it.

14. Your obligations

You are responsible for having a lawful basis for the processing you instruct, for giving your Visitors the notices the law requires and getting any consent it requires, for the accuracy of Customer Personal Data, for deciding who your App is for (including its audience's age, as the Terms say), and for making sure your instructions comply with Data Protection Law.

15. Liability, order and term

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of the Terms, except where Data Protection Law does not allow them. If this DPA and the rest of the Terms conflict about Customer Personal Data, this DPA controls; if the Standard Contractual Clauses apply and conflict with this DPA, they control. This DPA lasts as long as Basemodo processes Customer Personal Data for you. We may update it as the Terms describe, never to lower the protection it gives Customer Personal Data except where the law requires. Questions about this DPA: privacy@basemodo.com.