Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Subscription Agreement between KamSoft Consultants Ltd ("we") and the customer ("you") for SynaMark.

1. SynaMark does not process your data on our systems

SynaMark is tenant-resident. Its configuration, templates, images, audit history and your users' directory data are stored and processed within your own Microsoft 365 tenant, by software running in your users' Outlook clients and your administrators' browsers. They communicate only with Microsoft.

Accordingly, we do not process Customer Personal Data in providing the Service, and we are not your processor for it. Your agreement with Microsoft governs Microsoft's processing of that data.

This DPA exists to:

• (a) record that commitment;
• (b) govern the limited cases in which you choose to give us personal data, for example in a support request ("Support Data").

2. Definitions

"Controller", "processor", "personal data", "processing" and "personal data breach" have the meanings given in the UK GDPR, the EU GDPR (Regulation (EU) 2016/679) and the Swiss FADP. "Data Protection Law" means those laws and any other law that applies to the processing, including the CCPA as amended.

3. Our commitments about the Service

3.1 The SynaMark add-in and administration portal will not transmit Customer Personal Data to us. They will restrict network connections to Microsoft endpoints by Content Security Policy.

3.2 SynaMark uses delegated Microsoft Graph permissions only, as listed in our Privacy Policy. We will not add application permissions, or connections to endpoints outside Microsoft, without at least 60 days' notice to your subscription contacts.

3.3 Optional diagnostics are sent only to an Application Insights resource that you own and configure.

4. Support Data

Where you give us personal data in support requests, we process it as your processor, and we will:

(a) process it only to resolve your request, on your documented instructions;

(b) ensure everyone handling it is bound by confidentiality;

(c) protect it with the measures in Annex II;

(d) engage only the sub-processors listed on our Sub-processors page, giving 30 days' notice of changes, to which you may object;

(e) assist you with data subject requests and data protection impact assessments, taking into account the nature of the processing;

(f) notify you of a personal data breach affecting Support Data without undue delay, and in any event within 48 hours of becoming aware of it;

(g) delete Support Data within 24 months after the request is closed, or sooner on request;

(h) make available the information needed to demonstrate compliance with this DPA.

5. International transfers

To the extent Support Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the following apply:

• The Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, incorporated by reference. Clause 9 option 2 applies, and Clauses 17 and 18 are governed by the law and courts of Ireland.
• The UK International Data Transfer Addendum.

6. US state privacy laws

For Support Data, we act as your service provider. We will not sell or share it, or retain, use or disclose it for any purpose other than providing support.

7. Liability

Each party's liability under this DPA is subject to the limitations in the Subscription Agreement, except where Data Protection Law prohibits it.

---

Annex I — Description of processing (Support Data only)

Data subjects	Your administrators and staff who contact support, and any individuals you choose to mention
Categories of personal data	Names, business contact details, and the contents of support correspondence you provide
Special category data	None intended. Do not include it
Purpose	Resolving support requests
Duration	Until deleted under section 4(g)
Importer	KamSoft Consultants Ltd, 70 Water Lane, Ilford, IG3 9HT, United Kingdom. Contact: privacy@kamsoft.tech

Annex II — Technical and organisational measures

Product design.

• Tenant-resident architecture.
• Delegated permissions only, with site-scoped SharePoint access (Sites.Selected).
• Content Security Policy restricts the add-in and portal to Microsoft endpoints.
• No telemetry to KamSoft Consultants Ltd.

Secure development.

• Aligned with NIST SP 800-218 (SSDF) and OWASP ASVS Level 2.
• Mandatory code review.
• Static analysis (CodeQL), dependency auditing, secret scanning and software bill of materials (SBOM) on every change.
• Releases built and signed by an automated pipeline, with federated credentials instead of stored secrets.
• Independent penetration testing before general availability and annually afterwards.

Code integrity.

• Application code is served from Microsoft Azure over HTTPS, with content-hashed files.
• Production deployment requires approval.
• Dependencies may not run install scripts unless explicitly approved.

Access control.

• Phishing-resistant multi-factor authentication for our staff.
• Least privilege for our staff and systems.
• No standing administrative access to production.

Encryption.

• TLS 1.2 or later in transit.
• Encryption at rest for Support Data and marketplace records.

Incident response. Documented plan aligned with NIST SP 800-61, plus a public vulnerability disclosure policy.

Last updated 6 October 2026.