Acqua Travel eSIM Platform — Data Processing Agreement

1. Parties, roles and scope

1.1 This Data Processing Agreement ("DPA") is between Acqua Telecom, Forchwaldstrasse 30a, 6318 Walchwil, Switzerland ("Acqua", the processor) and the reseller that accepted the Acqua Travel eSIM Platform Reseller Terms (the "Reseller", the controller).

1.2 It applies to personal data of End Customers that Acqua processes on the Reseller's behalf to run the Reseller's Shop and deliver eSIMs ("Reseller Personal Data"). Annex 1 describes the processing.

1.3 It is drafted to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP), and any other data protection law that applies (together, "Data Protection Law"). Terms such as controller, processor, personal data and personal data breach have their meaning under the GDPR.

1.4 Outside scope. Acqua acts as an independent controller for: data about the Reseller and its staff; billing data for subscriptions that Acqua Travel bills to End Customers; and data Acqua must keep to meet its own legal, fraud-prevention or supplier obligations. Acqua's privacy notice covers that processing.

1.5 If this DPA conflicts with the Reseller Terms on personal data, this DPA prevails.

2. Acqua's obligations as processor

Acqua will:

1. process Reseller Personal Data only on the Reseller's documented instructions — these Terms, this DPA and the Reseller's use of the Platform settings — unless the law requires otherwise, in which case Acqua informs the Reseller first where lawful;
2. tell the Reseller if it believes an instruction breaks Data Protection Law;
3. ensure that everyone authorised to process the data is bound by confidentiality;
4. apply the technical and organisational measures in Annex 2;
5. help the Reseller, through the portal tools and on request, to answer End Customers' requests to access, correct, delete, restrict or port their data, and to object;
6. help the Reseller with data protection impact assessments and consultations with authorities, taking into account the nature of the processing;
7. keep a record of processing activities carried out for the Reseller.

The Reseller is responsible for having a lawful basis for the processing, giving End Customers a privacy notice that mentions Acqua as its service provider, and the lawfulness of its instructions.

3. Sub-processors

3.1 The Reseller gives general authorisation for Acqua to use sub-processors. The current list is in Annex 3.

3.2 Acqua will give at least 30 days' notice by email or in the portal before adding or replacing a sub-processor. The Reseller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Reseller may terminate the Reseller Terms without penalty as its only remedy.

3.3 Acqua will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to the Reseller for its sub-processors' performance.

4. International transfers

4.1 Acqua hosts the Platform in the United Kingdom (AWS, London region). Switzerland, the UK and the EU recognise each other as providing adequate protection.

4.2 Some sub-processors process data in other countries (see Annex 3). Where a transfer goes to a country without an adequacy decision, Acqua relies on the EU Standard Contractual Clauses (Module 3, processor to processor, or Module 2 where applicable), with the UK International Data Transfer Addendum and the Swiss adaptations, and on supplementary measures where needed.

4.3 To deliver an eSIM, the ICCID and limited technical data are shared with the network supplier and the local operators that carry the End Customer's traffic in the country of travel. This is necessary to perform the service the End Customer bought.

5. Breaches, audits, deletion and liability

5.1 Personal data breaches. Acqua will notify the Reseller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Reseller Personal Data. The notice will describe what happened, the data and people affected, likely consequences and the measures taken, with further details as they become known. Acqua will not notify End Customers or authorities on the Reseller's behalf unless asked or required by law.

5.2 Audits. On request, once a year, Acqua will provide the information needed to show compliance with this DPA, such as security documentation and sub-processor certifications. If that is not enough, the Reseller may audit Acqua, at its own cost, on 30 days' notice, during business hours, by an independent auditor bound by confidentiality, without access to other resellers' data.

5.3 Return and deletion. At the end of the Reseller Terms, the Reseller may export its End Customer data from the portal for 30 days. Acqua then deletes Reseller Personal Data within 90 days, except what the law requires it to keep (for example accounting and telecoms records), which it keeps securely and only for that purpose. eSIM records needed to keep sold packages working are kept until those packages expire.

5.4 Liability. Liability under this DPA is subject to the limits in the Reseller Terms, except where Data Protection Law does not allow liability to be limited.

Annex 1 — Details of processing

Annex 2 — Security measures

• Encryption: HTTPS/TLS for all traffic; databases and backups encrypted at rest.
• Access control: role-based access in the portal, each reseller sees only its own data; staff access on a need-to-know basis, with individual accounts and logged access.
• Secrets: supplier and payment keys held in a managed secret store, never in code.
• Payments: card data handled only by Stripe (PCI DSS Level 1); Acqua stores payment references only.
• Network: servers behind a firewall, supplier APIs reached from fixed allow-listed IP addresses.
• Resilience: daily database backups, monitoring and alerting, documented restore procedure.
• Development: code reviewed before release; dependencies kept up to date; test and live environments separated.
• People: staff bound by confidentiality and trained on data protection.
• Incidents: incident response procedure with the 48-hour notification in clause 5.1.

Annex 3 — Sub-processors