Statement under Article 28 of the Data Act

Jurisdiction of the ICT infrastructure (Article 28(1)(a) of Regulation (EU) 2023/2854). The ICT infrastructure that DCXPS SE deploys for the processing of customer data in its services is located in the Czech Republic, a Member State of the European Union, and is subject to the law of the Czech Republic and of the European Union. Customer data, the Platform and the Management Plane of DCXPS SE are located in the European Union and are operated by DCXPS SE; no infrastructure located outside the European Union, and no infrastructure operated by an entity established outside the European Union, is used for them.

Measures against international governmental access in conflict with Union law (Article 28(1)(b)). DCXPS SE is established in the Czech Republic. To prevent international governmental access to, or transfer of, non-personal data held in the European Union where such access or transfer would conflict with Union law or Czech law, DCXPS SE applies the following technical, organizational and contractual measures: encryption of customer data at rest, with keys held in the European Union, and encryption of data in transit to customer-facing endpoints; legal review of every request under its Government Access Protocol; compliance with a decision of a third country only where an international agreement in force gives effect to it or the customer concerned instructs it, and challenge of every other such decision; disclosure of the minimum data permissible; notification of the customer before any disclosure wherever the law permits; legal, technical and organizational separation from DCXPS Inc., a separate legal entity in the United States, which has no access to the infrastructure or the data of DCXPS SE; audit rights of customers; an annual penetration test by an independent tester; and an annual transparency report. The Government Access Protocol is published at chapek.io/legal.

This page. chapek.io/legal. The page shows the date of its last update. This page is listed in every contract of DCXPS SE for data processing services (Article 28(2) of Regulation (EU) 2023/2854).