Sovereignty, Security and Assurance Annex

A.1 Scope. This Annex forms part of the Master Services Agreement between DCXPS SE and the Customer (the "Agreement") and applies to every Order. Capitalized terms, including "DCXPS", have the meaning given in the Agreement. Parts B, C and D apply to all Services. Part E applies where the Order Schedule identifies the Customer as a financial entity within the scope of Article 2 of DORA.

A.2 Nature of statements. Every statement in this Annex that describes how DCXPS provides the Services, or a state of affairs that DCXPS maintains, binds DCXPS to provide the Services in that manner and to maintain that state of affairs. No measure, item of evidence or attestation described in this Annex is represented as audited, certified or assessed by a third party unless section B.6 states that the certificate or report concerned has been issued.

A.3 Precedence. Clause 2.3 of the Agreement governs the precedence of this Annex. Within this Annex, Part E prevails over Parts B to D where Part E applies.

A.4 Changes. DCXPS may change this Annex under clause 26.4 of the Agreement. A Change that reduces a Sovereignty Commitment, a Sovereignty Criterion or another commitment in Part B applies to a running Order only from the start of its next Service Period unless the Change is required by law; a Change that extends a commitment binds DCXPS from the date stated in the notice. The following are not Changes and take effect on notice through the Platform:

(a) an update of the subcontractor register in section B.4 under clause 23.2 of the Agreement;

(b) an update of the column "Held at the date of this Annex" in section B.6 under section B.3.2; and

(c) an update of the contacts in section D.2 or of the web page text in section D.1.

B.1 Sovereignty Criteria

B.1.1 Commitment. DCXPS shall provide the Services in conformity with each Sovereignty Criterion set out in the table below for as long as it provides Services, or holds Customer Data or Account Data, under the Agreement. DCXPS maintains the evidence listed against each Sovereignty Criterion. An item marked "available" exists at the date of this Annex; DCXPS completes every other item under section B.3.1.

No.	Sovereignty Criterion	DCXPS commitment	Evidence maintained
1	Establishment in the Union	DCXPS is established in the Union and has its registered seat, central administration, management, staff, banking and accounting in the Czech Republic (clause 6.1(a) of the Agreement).	Commercial Register extract (available); VAT registration record
2	Location of infrastructure and assets	All infrastructure and assets used to provide the Services, including the Units, the DCXPS Facility, the networks, the Management Plane, the systems on which the Platform runs and the infrastructure of subcontractors, are located in the Union; the Payment Processor is established in the Union (Sovereignty Criterion 6) and its infrastructure is outside this criterion. Unit 001 is located at the DCXPS Facility in the Czech Republic (clause 6.1(b) of the Agreement).	List of facilities with addresses; asset register; network diagrams; list of the locations of the Platform systems
3	Location of data	Customer Data, Account Data and Service Telemetry are stored and processed by DCXPS and its processors only in the Union (clauses 6.1(c) and 12.2 of the Agreement); the card schemes through which the Payment Processor settles card payments act as independent controllers of card payment data under the Privacy Notice and are outside this criterion. No person acting for DCXPS or for a subcontractor accesses them from a Third Country. Access by the Customer and its Users is determined by the Customer.	Data-flow diagrams; access logs; backup policy; the DPA
4	No Third-Country control	DCXPS is not controlled, directly or indirectly, by any natural or legal person established in a Third Country, and no such person holds five percent (5%) or more of its share capital or voting rights (clause 6.2 of the Agreement).	Commercial Register extract (available); shareholder register; declarations of the ultimate beneficial owners; articles of association; governance rules
5	Personnel	Every person with physical or logical access to the servers, the Units, the Platform, the Management Plane or Customer Data satisfies section B.5: assessed by DCXPS as qualified for the work for which the access is granted, authorized by DCXPS to perform it and, where the person has logical access, screened under section B.5.1(b) (clause 6.7 of the Agreement).	Personnel register; identity documents; screening records; access-control policy
6	Subcontractors and Payment Processor	Every subcontractor that performs a part of the Services, and the Payment Processor, is established in the Union, is not controlled, directly or indirectly, by a person established in a Third Country, performs its services for DCXPS only in the Union (the settlement of card payments through the card schemes is outside this criterion; Sovereignty Criterion 3) and is listed in section B.4 (clauses 6.1(b) and 23.2 of the Agreement).	Subcontractor register (section B.4); attestation by DCXPS on the due diligence performed for each subcontractor
7	Support from the Union	Support under section 3 of the SLA, security operations, network operations and field service are initiated and performed only from the Union, by personnel who satisfy section B.5, using systems located in the Union. The vendor warranty under Layer 4 of the SLA is limited to the delivery of replacement parts and gives the vendor no access to Customer Data, the Platform or the Management Plane; the vendor cloud services listed in section B.4 receive hardware telemetry only, under section B.2.7. No support function is performed from a Third Country (clause 6.1(d) and (e) of the Agreement).	Attestation by DCXPS on the support arrangements; documentation of the administrative access paths; locations of the security and network operations functions; inventory of the vendor cloud connections (section B.7.2)
8	Software supply chain	DCXPS maintains a software bill of materials, an inventory of the components of Third-Country vendors with the controls applied to their remote features, source-code audits where source access exists, a migration plan for each Third-Country dependency and an open-source policy, as set out in section B.7 (clause 6.4 of the Agreement).	Software bills of materials; component inventory with origin; verification results for remote-feature controls; audit records; migration plans; open-source policy
9	No training on Customer Data	DCXPS does not use Customer Data, Exportable Data or data generated by the Customer's use of the Services to train, fine-tune, evaluate or improve any AI model or system, and binds its subcontractors to the same prohibition (clause 6.8 of the Agreement).	Subcontract clauses; training records and model cards for any AI model that DCXPS operates
10	Government access	DCXPS handles every Government Access Request under Part C: no voluntary disclosure; no mechanism that enables access by a public authority outside Part C; compliance with a decision of a Third Country only through a Czech order under an international agreement in force or on the Customer's documented instruction; minimum disclosure; notification of the Customer (clause 6.5 of the Agreement).	Register of requests; handling records; annual transparency report (section C.5)
11	Transparency statement	DCXPS publishes, and keeps current, the statement in section D.1 on the jurisdiction to which its ICT infrastructure is subject and on its measures against international governmental access that conflicts with Union law or Czech law (Article 28 of the Data Act; clause 6.6 of the Agreement).	Published web page showing the date of its last update (published before the first Order under the Agreement)
12	Affiliate separation	DCXPS Inc. and every other Affiliate of DCXPS established in a Third Country are legally, technically and organizationally separated from the Services as set out in section B.8. None of them holds credentials, keys, privileged accounts or retrieval rights. DCXPS procures that DCXPS Inc. refers to DCXPS every Government Access Request that it receives concerning Customer Data or Account Data (clause 6.3 of the Agreement).	Separation policy; access reviews; inventory of privileged accounts; records of referred requests

B.2 Operational commitments

B.2.1 Dedicated servers. The servers allocated to the Customer under an Order, including their local storage, are dedicated to the Customer for as long as the Order is in force and are not shared with any other customer. The dedicated storage and the private networking under clause 4.1(b) of the Agreement are logically separated from the storage and networks of other customers. DCXPS verifies every replacement part against the hardware configuration of the Order before installing it.

B.2.2 Premises. The Customer acquires no right to use any defined space in the DCXPS Facility (clause 5.2 of the Agreement). Visits by the Customer take place on Business Days, by appointment requested through the Platform at least one (1) Business Day in advance and confirmed by DCXPS through the Platform, under the continuous escort of DCXPS personnel and in compliance with the access rules of the site operator, for audits under clause 21.1 of the Agreement and for other visits agreed through the Platform or in the Order Schedule.

B.2.3 Facility access. DCXPS controls access to the Units and to the hall in which they are installed, admits every person to them only under its personnel access protocol, verifies the identity of every person admitted and logs every access. DCXPS does not control the perimeter of the site, which the site operator controls under its own security directives. DCXPS keeps the access records for the hall in which the Customer's servers are installed until twelve (12) months after the end of the last Service Period of the Order concerned.

B.2.4 Hardware management. DCXPS manages the server and switch hardware, including power state and hardware health, only through the Out-of-Band Management Network and from within the DCXPS Facility (clause 4.5 of the Agreement). The Out-of-Band Management Network is not connected to any data-plane network of the Customer or of other customers. DCXPS logs every management session on the Out-of-Band Management Network and every maintenance session on the Customer's servers, recording the person, the purpose, the start and end, the devices accessed and the changes made. DCXPS keeps the log until twelve (12) months after the end of the last Service Period of the Order concerned. DCXPS makes the entries concerning the Customer's servers available to the Customer on request and at an audit under clause 21.1 of the Agreement.

B.2.5 Administrative access. Administrative access to the Management Plane and to the administration functions of the Platform is possible only from systems that DCXPS controls in the Union, by personnel who satisfy section B.5, with multi-factor authentication, and is logged. No system of DCXPS Inc., of any other Affiliate of DCXPS established in a Third Country or of any other person established in a Third Country has access to Customer Data, the Customer's servers, the Management Plane or the administration functions of the Platform. DCXPS permits no vendor support tunnel, vendor remote diagnostic session or other access path from a Third Country to any of them; the vendor cloud services listed in section B.4 receive only the hardware telemetry described in section B.2.7, through outbound connections that DCXPS initiates, controls and logs, and obtain no control of the servers or the network equipment and no access to Customer Data, the Platform or the Management Plane. Where a warranty or support case requires diagnostic output for a vendor, DCXPS personnel collect it with tools that DCXPS controls and transmit it to the vendor only after removing any Customer Data from it; the vendor obtains no access to the servers, the Units, the Platform or Customer Data.

B.2.6 Integrity of updates. DCXPS installs firmware and software updates on the Units, and on the components of the Customer's servers that DCXPS maintains, only from images published by the vendor or by the open-source project concerned and verified against its signature or published hash. DCXPS records the versions before and after each update in the maintenance log. DCXPS performs an update that requires downtime of the Customer's servers as Planned Maintenance or as emergency maintenance under section 5 of the SLA.

B.2.7 Telemetry and vendor remote features. DCXPS configures no component of the Platform or of the Management Plane, and no component that stores or processes Customer Data, to transmit telemetry, usage data, crash reports, license checks or diagnostics to a system located in a Third Country, and disables or blocks every such vendor remote feature known to it, including telemetry, call-home, cloud management, remote support and license activation, in the configuration of the components that it installs or maintains and at the network layer on the Management Plane and the Out-of-Band Management Network. The only exception is the vendor support telemetry of the servers and the network equipment (hardware inventory, health and licensing data, without Customer Data and without the content of the Customer's workloads) that the vendor cloud services listed in section B.4 receive through outbound connections that DCXPS initiates, controls, logs and records in the inventory under section B.7.2; DCXPS configures those connections so that the vendor obtains no control of the servers or the network equipment and no access to Customer Data, the Platform or the Management Plane. Software that the Customer installs or configures, and traffic that the Customer initiates from its servers, are outside this section.

B.2.8 Media sanitization. DCXPS sanitizes, by cryptographic erasure and purge in accordance with NIST Special Publication 800-88 Revision 2, every data-bearing medium that fails or is replaced, before the medium leaves the DCXPS Facility, including before its return to a vendor under warranty. A medium that cannot be sanitized in that manner leaves the DCXPS Facility only after its physical destruction. After the Retrieval Period, DCXPS sanitizes in the same manner every data-bearing medium allocated to the Customer before the medium is allocated to another customer or leaves the DCXPS Facility. DCXPS confirms each sanitization in writing, stating the serial number of the medium (clause 10.4 of the Agreement).

B.2.9 Encryption and keys. DCXPS encrypts Customer Data at rest on all storage allocated to the Customer, encrypts data in transit and manages encryption keys as set out in items 4 and 6 of Annex B of the DPA. DCXPS holds the keys that it manages only in systems located in the Union. Where the Order provides for Customer-managed keys, or where the Customer encrypts Customer Data with keys that it generates and holds, DCXPS holds no copy of those keys and cannot restore access to data encrypted with them (clause 7.5 of the Agreement).

B.3 Evidence and non-conformity

B.3.1 Evidence. DCXPS completes the evidence listed in section B.1 before the RFS Date of the first Order under the Agreement, reviews it at least once a year and updates it on every change. The evidence is Confidential Information of DCXPS (clause 14.1 of the Agreement). Contracts with subcontractors, lessors, suppliers and insurers are not part of the evidence; DCXPS provides attestations, extracts from public registers and certificates in their place. DCXPS makes it available to the Customer within ten (10) Business Days after a request through the Platform, and to the Customer's auditor under clause 21.1 of the Agreement.

B.3.2 Certifications and targets. DCXPS notifies the Customer through the Platform within ten (10) Business Days when a certificate or report listed in section B.6 is issued, suspended or withdrawn or is not renewed. If DCXPS does not obtain a certification or attestation listed in section B.6 by its target date, DCXPS notifies the Customer without undue delay, stating the reasons and a revised date. If DCXPS does not obtain it within six (6) months after the target date, the Customer may terminate the affected Order on thirty (30) days' notice; DCXPS refunds the Term Fee pro rata for the unused part of the Service Period, and clause 8.8 of the Agreement applies to the payment of the refund. The termination right lapses when DCXPS obtains the certification or attestation, and it is the Customer's sole remedy for the delay.

B.3.3 Non-conformity. If DCXPS becomes aware that the Services do not conform to a Sovereignty Criterion or to another commitment in this Part B, DCXPS shall

(a) notify the Customer through the Platform and by e-mail within twenty-four (24) hours;

(b) contain the non-conformity without undue delay;

(c) restore conformity; and

(d) deliver a root-cause report within ten (10) Business Days after the notice.

A non-conformity with a Sovereignty Criterion that DCXPS has not remedied within thirty (30) days after the day on which it became aware of the non-conformity or, where DCXPS has given no notice, after the Customer's written notice of the non-conformity, is a failure to satisfy clause 6.1 or, for Sovereignty Criterion 12, clause 6.3 of the Agreement within the meaning of clause 9.5(c) of the Agreement. A change in the ownership or control of DCXPS is governed by clauses 6.2 and 9.5(a) of the Agreement and not by this section.

B.3.4 Verification. DCXPS makes available to the Customer, on request through the Platform and within the period in section B.3.1, the access records under section B.2.3, the log entries under section B.2.4 and the maintenance records for the Customer's servers. Clause 21.1 of the Agreement governs audits.

B.4 Subcontractor register

B.4.1 Register. DCXPS completes the register below before the first Order under the Agreement and updates it on every change. DCXPS gives notice of every new subcontractor with access to the servers, the Units, the Platform or Customer Data under clause 23.2 of the Agreement. A supplier that delivers equipment, spare parts or software to DCXPS and has no physical or logical access to the servers, the Units, the Platform or Customer Data is not a subcontractor. The lessor of the Units, the owner of the site and the suppliers of electricity and connectivity are not subcontractors; they have no operational role, no credentials and no logical access. DCXPS operates the access control, surveillance, power, cooling and other systems of the Units and of the hall in which they are installed.

Subcontractor	Role	Established in	Ownership and control	Access
Facility services provider	Maintenance of power, cooling and fire protection systems	Czech Republic	Established and controlled in the Union; no ownership or control by a person established outside the EEA	Physical, escorted; no logical access
Hardware maintenance partner	Field service for servers and network equipment	Czech Republic	Established and controlled in the Union; no ownership or control by a person established outside the EEA	Physical, escorted, by personnel who satisfy section B.5; no logical access to Customer Data
Security operator	Physical security of the DCXPS Facility	Czech Republic	Established and controlled in the Union; no ownership or control by a person established outside the EEA	Common areas of the DCXPS Facility; no logical access
Network detection sensor supplier	Supply and remote support of the network detection sensors used by DCXPS for security monitoring	United States	Established and controlled outside the EEA	Remote access to the sensors for provisioning, support and updates, initiated through the Management Plane and logged; security telemetry and alerts only; no access to the content of Customer Data, the servers or the Units
Hardware vendor cloud services	Cloud-based inventory, health monitoring, licensing and warranty support services of the vendor of the servers and the network equipment (Cisco Intersight, Nexus Dashboard, Smart Licensing and Secure Firewall cloud services), used by DCXPS and by the hardware maintenance partner for vendor support (section B.2.7)	United States	Established and controlled outside the EEA	Outbound hardware inventory, health and licensing telemetry only, initiated, controlled and logged by DCXPS; no Customer Data; no control of the servers or the network equipment; no access to the Platform, the Management Plane or Customer Data
Billing platform provider	Metering, invoicing, subscription management and payment orchestration for Platform orders; processor under the DPA; Customer billing data stored and processed in the Union	Netherlands	Established in the Union; founders and management established in the Union	Customer account and contact data, usage metering records, invoicing and payment-status data; no access to the servers, the Units or the content of Customer Data
Payment Processor	Acquiring of card and bank-transfer payments for Platform orders through the billing platform’s checkout; independent controller; PCI DSS	Netherlands	Credit institution authorised and supervised in the Union; listed on an EU regulated market	Payment data only; no access to the servers, the Units, Customer Data or the billing platform’s other records

B.5 Personnel criteria

B.5.1 Criteria. Every person, whether engaged by DCXPS or by a subcontractor, who has physical or logical access to the servers, the Units, the Platform, the Management Plane or Customer Data (clause 6.7 of the Agreement) shall:

(a) have been assessed by DCXPS as qualified for the work for which the access is granted and be authorized by DCXPS to perform it; and

(b) where the person has logical access, have passed identity verification, a check of employment and education history and sanctions screening, and have provided an extract from the criminal record not older than three (3) months at onboarding and renewed every two (2) years.

B.5.2 Register. DCXPS keeps a register of the persons covered by section B.5.1, stating role, scope of access and verification dates. DCXPS makes the register available to the Customer on request, in pseudonymized form except where the Order requires named personnel, and reviews it at every audit.

B.5.3 Security roles. The cybersecurity manager and the administrators of the Platform are personnel who satisfy section B.5.1 and are engaged by DCXPS directly or through a subcontractor listed in section B.4. The security operations function is performed by employees of DCXPS or by a subcontractor listed in section B.4. No such role is held by, or shared with, personnel of DCXPS Inc.

B.5.4 Escort. A person who does not satisfy section B.5.1, including a visitor, an auditor or an engineer of a vendor, has physical access to the Units only under the continuous escort of personnel who do and has no logical access.

B.6 Certification and assurance roadmap

DCXPS shall meet the target stated for each item in the table below and shall maintain each certification and attestation once obtained (clause 6.9 of the Agreement); section B.3.2 governs a missed target for a certification or attestation. A certification or attestation that the column "Held at the date of this Annex" marks "No" is not held, and DCXPS represents it as held only after giving notice of its issue under section B.3.2.

Certification or attestation	Scope	Held at the date of this Annex	Target	Evidence to the Customer
ISO/IEC 27001	Information security management system of DCXPS covering the DCXPS Facility, the Platform and the operation of the Services	No	Certification by an accredited certification body by December 31, 2027	Certificate and statement of applicability, on request
SOC 2 Type II report	None	No; not claimed	None committed under this Annex	None
Facility design	DCXPS Facility (Unit 001)	Designed to be Tier II compliant; no Uptime Institute certification	No certification	Summary of the design, on request
Cybersecurity risk-management measures	Measures under Article 21 of Directive (EU) 2022/2555, as transposed by Act No. 264/2025 Coll., on Cybersecurity, applied whether or not DCXPS is a regulated entity under that Act; registration with the National Cyber and Information Security Agency where that Act requires it	Not yet in operation; not registered; self-assessment of applicability not yet performed	Measures in operation from the RFS Date of the first Order under the Agreement; self-assessment every year	Self-assessment report and, where applicable, confirmation of registration
Penetration test	Platform and shared infrastructure, by an independent tester (clause 13.4 of the Agreement)	No	First test before the RFS Date of the first Order under the Agreement; then every year	Executive summary on request; findings concerning the Customer's servers in full
Statement under Article 28 of the Data Act	Section D.1	No; not yet published	Published before the first Order under the Agreement	Public web page
Transparency report on Government Access Requests	Section C.5	No	Every year, within three (3) months after the end of each calendar year in which DCXPS provides Services	Public web page

B.7 Software supply chain and Third-Country dependencies

B.7.1 Software bill of materials. DCXPS maintains a software bill of materials in a machine-readable format (SPDX or CycloneDX) for the Platform, the Management Plane, the Pre-installed AI Stack, the operating system images, drivers and container images that DCXPS installs, and the firmware of the servers, the network equipment and the baseboard management controllers. For each component it states the version, supplier, country of origin, license and hash. DCXPS updates the bill of materials with every release of the Pre-installed AI Stack and every firmware update. DCXPS makes the part applicable to the Customer's servers available through the Platform on request (clause 6.4 of the Agreement).

B.7.2 Inventory of Third-Country components. DCXPS keeps an inventory of the components that originate from vendors established in a Third Country. For the current generation of Units, the inventory covers at least GPU drivers, CUDA libraries and GPU monitoring agents; server and baseboard management controller firmware; network operating systems and switch firmware; and the cloud-management agents, license-activation functions, cloud-based threat-intelligence services and warranty call-home functions of the vendors of the servers, the network equipment and the security appliances. For each component, the inventory records the remote features present, the control applied (disabled, blocked or removed, or permitted as vendor support telemetry under section B.2.7), the status of any source-code audit and the migration plan.

B.7.3 Verification of remote-feature controls. DCXPS records in the inventory the configured state of each remote feature known to it and the control applied under section B.2.7, verifies that state at every major firmware or software release and makes the verification results available with the evidence under section B.3.1.

B.7.4 Source-code audits. Where DCXPS has source access to a component that is relevant to security, including open-source components and vendor components under source-access agreements, DCXPS performs or procures a source-code audit at adoption and at every major version change. Where no source access exists, DCXPS records the compensating controls and the migration plan.

B.7.5 Migration plans. For each Third-Country dependency without which a Unit would not perform one of its functions, DCXPS maintains a documented migration plan that identifies alternative components, the estimated effort and the trigger conditions (loss of supply, sanctions, a remote-control requirement of a vendor, a change of license). DCXPS reviews the plans every year and gives the Customer a summary on request.

B.7.6 Open-source software. DCXPS applies an open-source policy comprising provenance verification, pinned and reproducible builds, vulnerability monitoring, a review of the maintenance risk of each project and documented alternatives for unmaintained projects. DCXPS disables or removes the automatic-update and call-home features of the open-source components that it installs or maintains.

B.7.7 Vulnerability handling. DCXPS operates the coordinated vulnerability disclosure process under clause 13.3 of the Agreement at the contact stated in section D.2 and monitors the security advisories of the vendors of the components in the inventory. DCXPS starts the deployment of security patches to the Platform, the Management Plane, the firmware of the servers and the Pre-installed AI Stack within seven (7) days for a vulnerability rated critical and within thirty (30) days for a vulnerability rated high, counted from the day on which a fix becomes available; the rating is that of the vendor or, where the vendor gives none, that of DCXPS. DCXPS deploys a patch that does not interrupt the Services without notice. DCXPS deploys a patch that interrupts the Services as emergency maintenance under section 5.2 of the SLA for a vulnerability rated critical and otherwise as Planned Maintenance announced under section 5.1 of the SLA within the period above, subject to a deferral that the Customer requests under section 5.3 of the SLA.

B.8 Third-Country affiliate separation

DCXPS Inc. contracts with customers established in the United States under its own agreements. DCXPS Inc. has no contractual right and no technical means to access the Services, the DCXPS Facility, the Platform as operated by DCXPS SE or Customer Data: it holds no administrative credentials, decryption keys, privileged accounts or retrieval rights, and no personnel of DCXPS Inc. performs an operational, security or support function for DCXPS SE.

A Government Access Request concerning Customer Data or Account Data that is addressed to DCXPS Inc. is referred to DCXPS SE and handled under Part C (clause 6.3 of the Agreement). DCXPS SE maintains access reviews and an inventory of privileged accounts that demonstrate that DCXPS Inc. has no access. DCXPS SE does not represent that no authority of a Third Country will address an order to DCXPS Inc.

C.1 Principles. DCXPS

(a) does not disclose Customer Data or Account Data to any public authority voluntarily;

(b) maintains no mechanism, including key escrow, a backdoor or an interception capability, that enables a public authority to access Customer Data outside the procedure in this Part C;

(c) discloses data only under an order that is legally binding on DCXPS under Union law or Czech law, after the legal review under section C.2, or on the documented instruction of the Customer under section C.3;

(d) discloses the minimum amount of data permissible on a reasonable interpretation of the order (Article 32(5) of the Data Act);

(e) applies the technical, organizational and legal measures in this Annex to prevent international governmental access to, or transfer of, non-personal data held in the Union where such access or transfer would conflict with Union law or Czech law (Article 32(1) of the Data Act), and applies the same measures to personal data, for which Article 48 of the GDPR and the DPA also apply; and

(f) informs the Customer under section C.4.

C.2 Orders under Union law and Czech law. DCXPS's legal function reviews every order of a Czech court or authority, every European Production Order Certificate and European Preservation Order Certificate under Regulation (EU) 2023/1543 received at the designated establishment identified in section D.2, and every order under Article 9 or 10 of the DSA, for validity, scope and legal basis, without undue delay and in any event within the shorter of one (1) Business Day after receipt and the period that allows DCXPS to meet the applicable deadline. DCXPS complies with an order that is binding on it within the period that the law prescribes, as follows:

(a) for a European Production Order Certificate, DCXPS transmits the data requested within the period set by Article 10 of Regulation (EU) 2023/1543, which is at the latest ten (10) days after receipt and, in an emergency case, at the latest eight (8) hours after receipt;

(b) for a European Preservation Order Certificate, DCXPS preserves the data requested without undue delay; the obligation to preserve ends sixty (60) days after receipt unless the issuing authority confirms that a subsequent request for production has been issued, and the issuing authority may extend it within that period by an additional thirty (30) days (Article 11(1) of Regulation (EU) 2023/1543); where the issuing authority confirms a subsequent request for production, DCXPS preserves the data for as long as is necessary to produce them once that request is served;

(c) for an order to act against illegal content or an order to provide information under Article 9 or 10 of the DSA, DCXPS takes the measures under section 6.4 of the AUP that an order to act requires or provides the information that an order to provide information requires, informs the issuing authority without undue delay of the effect given to the order, and informs the Customer of the order and of the effect given to it at the latest when effect is given to the order or at the later time stated by the issuing authority in the order; and

(d) for any other order of a Czech court or authority, DCXPS complies within the period stated in the order or prescribed by Czech law.

Where DCXPS cannot comply with a certificate on a ground that Regulation (EU) 2023/1543 recognizes, DCXPS informs the issuing authority without undue delay, using the form that the Regulation provides. DCXPS uses the remedies available to it against an order that it considers unlawful or disproportionate and, where the law allows, preserves the data rather than producing them until the remedy is decided.

C.3 Third-Country decisions. A judgment of a court or tribunal, or a decision of an administrative authority, of a Third Country that requires DCXPS to transfer or to give access to Customer Data or Account Data is recognized or enforceable only where it is based on an international agreement in force between that Third Country and the Union or between that Third Country and the Czech Republic, such as a mutual legal assistance treaty (Article 32(2) of the Data Act; Article 48 of the GDPR). DCXPS transfers or gives access to data in response to such a judgment or decision only

(a) where a Czech court or authority gives effect to it under such an agreement, in which case section C.2 applies to the Czech order; or

(b) on the documented instruction of the Customer, for the Customer's own data.

DCXPS challenges every other such judgment or decision through the remedies available to it and does not transfer or give access to data under it, whether or not the conditions in Article 32(3) of the Data Act are met. For personal data, clause 12.2 of the Agreement and Annex D of the DPA apply in addition.

C.4 Customer notification. DCXPS informs the Customer of every Government Access Request concerning Customer Data or the Customer's Account Data before complying with it and in any event within two (2) Business Days after receipt, with a copy of the request where the law permits. This does not apply where the law, or an order issued under a law that permits it, prohibits the notification, or where the request serves law-enforcement purposes and the notification would prejudice the effectiveness of that activity; in those cases DCXPS informs the Customer as soon as the prohibition or the risk of prejudice ceases (clause 6.5(e) of the Agreement). For personal data, Annex D of the DPA applies in addition.

C.5 Records and transparency report. DCXPS keeps a record of every Government Access Request, its handling, the legal basis relied on and the data disclosed. Where the law permits, DCXPS makes the entries concerning the Customer available to it on request and at an audit under clause 21.1 of the Agreement. Within three (3) months after the end of each calendar year in which it provides Services, DCXPS publishes on the web page identified in section D.1 the number of requests received in that year by category (Czech, other Member State, Third Country), the number complied with in whole or in part and the number challenged, without identifying any customer.

C.6 Contact. The designated establishment and the contact point for Government Access Requests are identified in section D.2. DCXPS procures that DCXPS Inc. refers to DCXPS without undue delay every Government Access Request that it receives concerning Customer Data or Account Data (clause 6.3 of the Agreement and section B.8), and DCXPS handles a referred request under this Part C.

D.1 Statement under Article 28 of the Data Act (web page text)

International access and transfer: statement for publication Jurisdiction of the ICT infrastructure (Article 28(1)(a) of Regulation (EU) 2023/2854). The ICT infrastructure that DCXPS SE deploys for the processing of customer data in its services is located in the Czech Republic, a Member State of the European Union, and is subject to the law of the Czech Republic and of the European Union. Customer data, the Platform and the Management Plane of DCXPS SE are located in the European Union and are operated by DCXPS SE; no infrastructure located outside the European Union, and no infrastructure operated by an entity established outside the European Union, is used for them. Measures against international governmental access in conflict with Union law (Article 28(1)(b)). DCXPS SE is established in the Czech Republic. To prevent international governmental access to, or transfer of, non-personal data held in the European Union where such access or transfer would conflict with Union law or Czech law, DCXPS SE applies the following technical, organizational and contractual measures: encryption of customer data at rest, with keys held in the European Union, and encryption of data in transit to customer-facing endpoints; legal review of every request under its Government Access Protocol; compliance with a decision of a third country only where an international agreement in force gives effect to it or the customer concerned instructs it, and challenge of every other such decision; disclosure of the minimum data permissible; notification of the customer before any disclosure wherever the law permits; legal, technical and organizational separation from DCXPS Inc., a separate legal entity in the United States, which has no access to the infrastructure or the data of DCXPS SE; audit rights of customers; an annual penetration test by an independent tester; and an annual transparency report. The Government Access Protocol is published at chapek.io/legal. This page. chapek.io/legal. The page shows the date of its last update. This page is listed in every contract of DCXPS SE for data processing services (Article 28(2) of Regulation (EU) 2023/2854).

D.2 Contacts and designations

Purpose	Legal basis	Designation
Single point of contact for the authorities of the Member States, the Commission and the European Board for Digital Services	Article 11 of the DSA	legal@chapek.io; postal address: the registered seat of DCXPS; languages: English and Czech
Single point of contact for recipients of the service	Article 12 of the DSA	support@chapek.io and the support function of the Platform; languages: English and Czech
Notice and action mechanism for allegedly illegal content	Article 16 of the DSA; section 6 of the AUP	support@chapek.io; web form at chapek.io/legal/notice
Designated establishment for European Production Orders and European Preservation Orders	Article 3 of Directive (EU) 2023/1544; Regulation (EU) 2023/1543	DCXPS SE at its registered seat; legal@chapek.io
Legal notices and other Government Access Requests	Clauses 6.5 and 24.1 of the Agreement; Part C	legal@chapek.io; postal address: the registered seat of DCXPS
Contact point for the National Cyber and Information Security Agency	Act No. 264/2025 Coll., on Cybersecurity, where DCXPS is a regulated entity under that Act	security@chapek.io; designated on registration where that Act requires it
Data protection officer or privacy contact	Articles 37 to 39 of the GDPR, where a data protection officer is designated	support@chapek.io
Security incidents and coordinated vulnerability disclosure	Clauses 13.2 and 13.3 of the Agreement; Article 21 of Directive (EU) 2022/2555, as transposed by Act No. 264/2025 Coll.; section B.7.7	security@chapek.io; OpenPGP key published at chapek.io/legal
Switching and exit	Chapter VI of the Data Act; clause 10 of the Agreement	switching@chapek.io

E.1 Application. This Part E applies where the Order Schedule identifies the Customer as a financial entity within the scope of Article 2 of DORA. Where the Order Schedule states that the Services support a critical or important function of the Customer, the whole of this Part E applies. Otherwise, the rows of the table in section E.2 that implement Article 30(2) of DORA, and sections E.3 and E.4, apply.

E.2 Contractual provisions. The following terms implement Article 30(2) and (3) of DORA, in the order of that Article.

DORA provision	Addendum term	Related provisions
Article 30(2)(a): description of all functions and ICT services; conditions for subcontracting ICT services that support critical or important functions	The Order Schedule describes all functions and ICT services provided, states for each whether it supports a critical or important function and lists the subcontracted elements and the conditions of subcontracting. DCXPS may subcontract an ICT service that supports a critical or important function, or a material part of it, only to a subcontractor established in the Union and listed in section B.4, under clause 23.2 of the Agreement and the regulatory technical standards on subcontracting adopted under DORA. DCXPS remains responsible for the subcontracted service and binds the subcontractor to grant the Customer and the competent authority the rights in row (3)(e).	Order Schedule; section B.4; clause 23.2
Article 30(2)(b): locations of the functions and ICT services and of data processing and storage; advance notice of changes	The servers and the Customer Data stored on them are located at the DCXPS Facility identified in the Order, in the Czech Republic. The Platform, Account Data, Service Telemetry and backup copies are processed and stored in the Czech Republic. Subcontractors perform their services only in the Union. No function, ICT service, processing or storage takes place outside the Union. DCXPS notifies the Customer at least ninety (90) days before any intended change of such a location.	Sovereignty Criteria 2, 3 and 6; clause 6.1
Article 30(2)(c): availability, authenticity, integrity and confidentiality of data, including personal data	The measures in this Annex and in Annex B of the DPA apply. DCXPS reports on their implementation to the Customer through the Platform once a year.	Parts B and C; Annex B of the DPA
Article 30(2)(d): access, recovery and return of data on insolvency, resolution or discontinuation of the business operations of DCXPS and on termination	DCXPS ensures that the Customer can access, recover and retrieve its Customer Data and Exportable Data in a structured, commonly used and machine-readable format (a) on termination, under clause 10 of the Agreement; and (b)on the insolvency, resolution or discontinuation of the business operations of DCXPS, through the export interfaces described in the Documentation.	Clause 10
Article 30(2)(e): service level descriptions, including updates and revisions	The SLA applies. DCXPS delivers the monthly service report under section 8 of the SLA through the Platform. The SLA is updated or revised only by written agreement (clause 26.4 of the Agreement).	SLA; clause 26.4
Article 30(2)(f): assistance in ICT incidents related to the ICT service, at no additional cost or at a cost determined ex ante	DCXPS assists the Customer at no additional cost in every ICT-related incident that is related to the Services, including by providing the information that the Customer requires to classify and report the incident under Chapter III of DORA within the periods the Customer notifies. Other assistance is charged at the rates stated in the Order Schedule.	Clause 13.2; SLA; Order Schedule
Article 30(2)(g): cooperation with the competent authorities and resolution authorities	DCXPS cooperates fully with the competent authorities and the resolution authorities of the Customer and with the persons they appoint, including by granting them access to the DCXPS Facility.	Clause 21.3
Article 30(2)(h): termination rights and minimum notice periods	The Customer may terminate an Order in the circumstances listed in Article 28(7) of DORA under section E.4. The notice periods are those in section E.4, in clause 9 of the Agreement and in the Order Schedule.	Section E.4; clauses 9 and 10
Article 30(2)(i): participation in ICT security awareness programs and digital operational resilience training	Personnel of DCXPS assigned to the Customer's Services take part in the Customer's ICT security awareness programs and digital operational resilience training where the Customer so requires, at the cost stated in the Order Schedule.	Order Schedule
Article 30(3)(a): full service level descriptions with precise quantitative and qualitative performance targets	The SLA states the quantitative and qualitative performance targets. Where a target is missed, DCXPS takes corrective action without undue delay and reports it in the monthly service report.	SLA, sections 2 to 4 and 8
Article 30(3)(b): notice periods and reporting obligations, including notification of developments with a material impact	DCXPS notifies the Customer without undue delay of any development that may have a material impact on its ability to provide the Services in line with the agreed service levels, in addition to its notification duties under clauses 4.7, 6.2 and 13.2 of the Agreement and section B.3.3.	Clauses 4.7, 6.2 and 13.2; section B.3.3
Article 30(3)(c): business contingency plans and their testing; ICT security measures, tools and policies	DCXPS implements business contingency plans for the DCXPS Facility and the Platform, tests them at least once a year and gives the Customer a summary of the results. The ICT security measures, tools and policies in this Annex and in Annex B of the DPA apply.	Parts B and C; Annex B of the DPA
Article 30(3)(d): participation and full cooperation in threat-led penetration testing	DCXPS participates and cooperates fully in the Customer's threat-led penetration testing under Articles 26 and 27 of DORA on the terms in section E.5.	Section E.5; clause 13.4
Article 30(3)(e): unrestricted rights of access, inspection and audit	The Customer, a third party that it appoints and the competent authority have unrestricted rights of access, inspection and audit of DCXPS in respect of the Services, including the right to take copies of relevant documentation on site where the documentation is critical to the operations of DCXPS; the limits on frequency and notice in clause 21.1 of the Agreement do not apply. DCXPS cooperates fully during on-site inspections and audits by the competent authorities, the Lead Overseer, the Customer or a third party that it appoints. The scope, the procedures to be followed and the frequency of such inspections and audits are stated in the Order Schedule. The Customer may agree with DCXPS on alternative assurance levels where the rights of other customers of DCXPS are affected.	Clauses 21.1 and 21.3; Order Schedule
Article 30(3)(f): exit strategies and a mandatory adequate transition period	On a Switching Notice or on the termination of an Order, the transitional period under clause 10.2 of the Agreement is extended to the period stated in the Customer's exit plan and notified to DCXPS with the Switching Notice or the notice of termination, not exceeding twelve (12) months. During that period the Order remains in force, DCXPS continues to provide the Services and supports the Customer's migration to another provider or to in-house solutions, and the Term Fee is payable for each Service Period that starts during it.	Clause 10

E.3 Register of information. DCXPS provides to the Customer, before the first Order under the Agreement and within ten (10) Business Days after each later request, the information that the Customer requires to maintain its register of information under Article 28(3) of DORA, in the format of the implementing technical standards adopted under Article 28 of DORA. The information includes the identification data of DCXPS and its European Unique Identifier (EUID), the subcontractors listed in section B.4, the locations of the provision of the Services and of data storage, and the functions supported as stated in the Order Schedule.

E.4 Termination under Article 28(7) of DORA. The Customer may terminate an Order on thirty (30) days' notice where

(a) DCXPS commits a significant breach of applicable laws, regulations or contractual terms;

(b) circumstances identified through the Customer's monitoring of ICT third-party risk are deemed capable of altering the performance of the functions provided through the Order, including material changes that affect the Order or the situation of DCXPS;

(c) DCXPS has evidenced weaknesses in its overall ICT risk management, in particular in the way it ensures the availability, authenticity, integrity and confidentiality of data, whether personal data or non-personal data; or

(d) the competent authority can no longer effectively supervise the Customer as a result of the conditions of, or circumstances related to, the Order.

Clause 10 of the Agreement applies to the exit and, where the Services support a critical or important function, so does row (3)(f) of the table in section E.2. DCXPS refunds the Term Fee pro rata for the unused part of the Service Period in the cases under (a) and (c), and clause 8.8 of the Agreement applies to the payment of the refund; no refund is due in the cases under (b) and (d).

E.5 Threat-led penetration testing. The following terms apply to threat-led penetration testing under Article 26 of DORA that covers the Services:

(a) the Customer notifies DCXPS of the test at least three (3) months before it starts;

(b) before the test starts, the Parties agree in writing the scope, the timing, the testers, the rules of engagement and the measures that protect the services provided to other customers of DCXPS and their data;

(c) where the test would affect the shared infrastructure, the Platform outside the Customer's tenant or the services of other customers, DCXPS may require that the test be carried out as pooled testing to the extent that Article 26 of DORA permits it;

(d) testers who obtain physical access to the DCXPS Facility, or logical access beyond the Customer's own servers and tenant, satisfy section B.5 and are bound by obligations of confidentiality equivalent to clause 14 of the Agreement; and

(e) DCXPS participates at the cost stated in the Order Schedule.