Data Processing Agreement — Template

This is the template Data Processing Agreement (DPA) Berserk ApS offers to customers who, in the course of a support engagement or under a managed offering, share personal data with us. The DPA is the instrument by which Berserk ApS becomes a processor of personal data on the customer's instructions, with the customer remaining the controller under GDPR Article 4(7).

The version of this template effective on the date of execution is binding. Earlier versions remain binding for engagements that referenced them, until superseded.

Status: Template — present this to your legal team. Berserk welcomes minor edits and standard customer DPA forms; material edits trigger an internal legal review on our side.

---

Parties

This DPA is between:

• The Customer — the legal entity identified in the underlying service agreement, beta participation, or support engagement (the "Customer").
• Berserk ApS — Danish private limited company, registered address in Denmark ("Berserk").

Subject matter, duration, nature, and purpose

Item	Detail
Subject matter	Berserk processes personal data on the Customer's instructions in connection with the support engagement or managed offering.
Duration	The duration of the underlying engagement, plus any post-termination handover period.
Nature and purpose	Diagnostic review of telemetry the Customer shares; assistance with deployment, debugging, or operations.
Type of personal data	As selected by the Customer when sharing telemetry. Berserk does not pre-define the categories.
Categories of data subjects	Determined by the Customer (typically: Customer's end users, Customer's employees, system identifiers).

Roles

• The Customer is the controller (or, where the Customer is itself a processor for an upstream entity, the processor — and Berserk acts as sub-processor).
• Berserk is the processor, acting only on the Customer's documented instructions.

Customer instructions

The Customer's documented instructions to Berserk are:

1. Process the personal data shared by the Customer only for the support engagement or managed offering described in the underlying agreement.
2. Do not retain personal data beyond the engagement's reasonable handover period; on engagement closure, return or delete on instruction.
3. Do not transfer personal data outside the EU/EEA without prior written instruction from the Customer.

Additional instructions may be given in writing (including email).

Berserk's obligations

Berserk:

1. Processes personal data only on the documented instructions of the Customer, including with regard to international transfers, unless required to do otherwise by Union or Member State law to which Berserk is subject — in which case Berserk informs the Customer before processing, unless that law prohibits such information.
2. Ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implements the technical and organizational measures described in Annex A.
4. Engages sub-processors only with the Customer's prior general authorization, subject to the change-notification mechanism in Section "Sub-processors."
5. Assists the Customer, where reasonable, in fulfilling its obligations to respond to requests from data subjects exercising GDPR rights.
6. Assists the Customer in ensuring compliance with GDPR Articles 32 to 36 (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and the information available to Berserk.
7. At the Customer's choice, deletes or returns all personal data after the end of the provision of services, and deletes existing copies, unless storage is required by Union or Member State law.
8. Makes available to the Customer all information necessary to demonstrate compliance with these obligations and allows for and contributes to audits, in accordance with the "Audit" section.

Personal-data breach notification

If Berserk becomes aware of a personal-data breach affecting the Customer's data, Berserk notifies the Customer without undue delay, with a target of ≤24 hours from awareness. The notification includes, to the extent known at the time:

• The nature of the breach.
• Categories and approximate number of data subjects and records affected.
• The likely consequences.
• Measures Berserk has taken or proposes to take.

This commitment supplements the Customer's own GDPR Article 33 obligations to its supervisory authority. Berserk maintains an internal breach-notification procedure aligned with this commitment; it is available to enterprise customers under NDA on request.

Sub-processors

The Customer authorizes Berserk to engage sub-processors as listed at Sub-processors. Berserk:

• Imposes substantially equivalent data-protection obligations on each sub-processor.
• Notifies the Customer of any intended change concerning the addition or replacement of a sub-processor at least 30 days before the change.
• Allows the Customer to object on reasonable security or compliance grounds during the notice period; the parties shall in good faith agree on a resolution.

International transfers

Berserk does not transfer personal data outside the EU/EEA without the Customer's prior written instruction. Where transfer is necessary for a specific support engagement and the Customer instructs it, Berserk relies on the appropriate transfer mechanism (Standard Contractual Clauses 2021/914, or the destination country's adequacy decision).

Audit

The Customer may, no more than once per year, request a remote audit or written attestation from Berserk regarding the technical and organizational measures in Annex A. Berserk responds with the information available — typically the artifacts at Trust Overview and the SBOMs shipped in container images — and may charge reasonable costs for additional bespoke audit work.

If the Customer is itself subject to a regulator audit and the regulator requires direct access to Berserk's systems, Berserk reasonably cooperates, subject to confidentiality and proportionality.

Liability

Liability under this DPA is governed by the underlying service or support agreement. Where no underlying agreement specifies, Danish law applies.

Term and termination

This DPA is in force for the duration of the underlying engagement. Sections governing breach notification, return/deletion, audit, and liability survive termination to the extent necessary.

---

Annex A — Technical and Organizational Measures

These measures reflect Berserk ApS's controls as of the version date on this document. The current version is at Trust Overview and Security Whitepaper.

Area	Measure
Framework alignment	Internal control set mapped to NIS2 Article 21(2) and NIST CSF 2.0; target profile maintained per CSF function. Mapping available to the Customer under this DPA on request.
Encryption in transit	TLS on every external HTTP and gRPC interface; the Rust backend services use rustls (aws-lc-rs backend), and non-Rust surfaces use the hosting provider's TLS termination. Internal cluster traffic is over an authenticated Netbird overlay.
Encryption at rest	Provider-managed encryption-at-rest on Hetzner volumes and on the OCI registry. Internal K8s control-plane encryption-at-rest is on the roadmap.
Access control	SSH-key authentication; per-user accounts on customer-environment access (no shared admin); standing access to customer environments is not granted.
Authentication	Per-user accounts on Proton, GitHub, and other SaaS. 2FA is enabled on Proton and on personnel GitHub accounts; broader 2FA enforcement (SSH, every cloud console) is on the roadmap.
Logging	Per-host SSH logs; per-service application logs; aggregated audit logging is on the roadmap.
Personnel	Confidentiality obligations in employment contracts; security awareness on onboarding and annually.
Incident response	Documented severity matrix and incident response runbook; staged-reporting commitments per NIS2 Article 23 and GDPR Article 33.
Vulnerability management	Daily dependency-advisory scanning across every ecosystem; CycloneDX 1.6 SBOM in every shipped container image; coordinated vulnerability disclosure policy.
Sub-processors	Listed at Sub-processors, with 30-day change notice.
Backups	Postgres dump-and-restore on the engagement-relevant data; S3-as-trust-root model documented; annual recovery rehearsal.

Annex B — Data sharing log

For each engagement under this DPA, the parties record:

• Engagement reference.
• Categories of personal data shared.
• Purpose.
• Sharing and return/deletion dates.
• Engineer(s) granted access.

The log lives in the Customer's preferred system or, by default, Berserk's internal engagement record.

---

Signatures

[For execution by both parties; presented separately at engagement start.]