Data Processing Agreement

Effective Date: 10 August 2026 Service: ETL Console\ Owner: Igor Bobritskii PR Novi Sad Contact: support@etlconsole.com

This Data Processing Agreement (“DPA”) forms part of the Terms of Service for ETL Console and applies where ETL Console processes personal data on behalf of a Customer.

For the purposes of this DPA:

Customer means the individual user, business, or organization using the Service.\ \ Processor means Igor Bobritskii PR Novi Sad, the provider of ETL Console.\ \ Customer Personal Data means personal data processed by ETL Console on behalf of Customer through user-configured connections, staging jobs, transformations, target write operations, rejected rows, support requests, or related Platform operations.

1. Relationship of the Parties

For account, billing, security, subscription, support, and general Platform usage data, we may act as a data controller as described in our Privacy Policy.

For Customer Personal Data processed through user-configured data operations, Customer acts as the data controller and we act as the data processor.

Customer is solely responsible for determining:

whether it has the legal right to connect each data source;\ whether it has a lawful basis to process the data;\ whether the data may lawfully be processed through the Platform;\ whether any additional notices, consents, permissions, or safeguards are required.

2. Scope of this DPA

This DPA applies to the Hosted SaaS version of ETL Console.

For on-premise Enterprise deployments, this DPA applies only to personal data processed by us outside the customer-controlled environment, such as account, license, support, billing, diagnostic, or security information, unless a separate written agreement states otherwise.

If a separate written agreement applies to an Enterprise deployment, that agreement prevails over this DPA where there is a conflict.

3. Categories of Data

ETL Console may process two main categories of customer-related information.

3.1 Customer Metadata and Configuration Data

This may include:

connection names;\ schema names;\ table names;\ column names;\ data types;\ nullable flags;\ primary key and index information where available;\ mapping configuration;\ staging configuration;\ transformation configuration;\ job configuration;\ job status and execution history;\ technical logs and error context.

Customer metadata and configuration data may be stored by the Platform for as long as reasonably necessary to provide the Service, maintain user configurations, support troubleshooting, enforce security, and comply with retention rules.

3.2 Customer Source Data

Customer source data means data read, processed, transformed, staged, or written by the Platform according to Customer’s instructions.

By default, ETL Console is not intended to permanently store full customer source records in its internal database.

However, Customer source data may be:

temporarily processed in memory, workers, queues, logs, or technical components;\ displayed to authorized users in table details, previews, or analysis features;\ written to customer-configured staging or target systems;\ stored as rejected rows where the Customer explicitly enables rejected row storage.

Rejected rows may contain full or partial source records and may include personal data. Rejected row storage is disabled by default for each staging or transformation and may be enabled only with explicit user consent. Rejected rows are retained according to the Customer-configured retention period, with a default of 3 days and a maximum of 30 days.

4. Categories of Data Subjects

Customer Personal Data may relate to any individuals whose data is included in Customer-controlled sources, including:

Customer’s end users;\ employees;\ contractors;\ customers;\ suppliers;\ applicants;\ citizens;\ residents;\ business partners;\ or other individuals determined by Customer.

5. Nature and Purpose of Processing

We process Customer Personal Data only to provide, operate, secure, maintain, and support ETL Console.

Processing may include:

testing and managing connections;\ reading source metadata;\ reading source data according to user-configured jobs;\ displaying table details, previews, samples, and basic analysis;\ running staging jobs;\ running transformations;\ writing results to Customer-configured targets;\ storing mappings, stagings, transformations, and job configurations;\ logging job activity and technical errors;\ storing rejected rows when explicitly enabled by Customer;\ providing troubleshooting and support;\ maintaining security and preventing abuse.

6. Customer Instructions

We process Customer Personal Data only on documented instructions from Customer.

Customer’s documented instructions include:

the Terms of Service;\ this DPA;\ Customer’s account and workspace settings;\ connections created by Customer;\ mappings configured by Customer;\ staging and transformation settings;\ job execution requests;\ target destination settings;\ rejected row storage and retention settings;\ support requests;\ other instructions submitted through the Platform.

If we believe an instruction violates applicable law, we may notify Customer where legally permitted.

7. Customer Responsibilities

Customer is responsible for:

the legality of all data sources connected to the Platform;\ obtaining all required permissions, approvals, licenses, notices, and consents;\ ensuring that connected data may lawfully be processed through ETL Console;\ managing users, roles, permissions, and organization access;\ reviewing and validating mappings, transformations, and outputs;\ selecting appropriate retention settings;\ deciding whether rejected row storage is appropriate for each staging or transformation;\ responding to data subject requests where Customer is the controller.

Customer must not use ETL Console to process data it is not legally authorized to access or process.

8. Confidentiality

We will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data by our personnel is limited to authorized persons who need access for support, security, maintenance, troubleshooting, or operation of the Service.

9. Security Measures

We will implement reasonable technical and organizational measures designed to protect Customer Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include the controls described in Appendix 2 — Technical and Organizational Measures.

Customer acknowledges that no system can be guaranteed to be completely secure, uninterrupted, or error-free.

10. Subprocessors

Customer gives general authorization for us to engage subprocessors where necessary to provide, secure, support, maintain, and operate the Service.

Our current subprocessors and their purposes are identified on our Subprocessors page, which forms part of the information provided in connection with this DPA.

We will impose appropriate data protection obligations on subprocessors that process Customer Personal Data on our behalf, consistent with the requirements applicable to us under this DPA and applicable data protection law.

Where required by applicable law, we will provide reasonable notice before adding or replacing a subprocessor that processes Customer Personal Data. Customer may object to a new subprocessor within 15 days of notice where the objection is based on reasonable data protection grounds.

If the parties cannot reasonably resolve the objection, Customer may stop using the affected part of the Service or terminate the affected Service, subject to the Terms of Service.

11. International Transfers

Customer Personal Data may be processed in countries other than the country where Customer or the relevant data subjects are located.

Where an international transfer of Customer Personal Data requires additional safeguards under applicable data protection law, we will use an appropriate lawful transfer mechanism, which may include applicable Standard Contractual Clauses, adequacy decisions, or other legally recognized transfer safeguards.

Where required, we will reasonably cooperate with Customer in documenting the applicable transfer mechanism.

12. Personal Data Breach

If we become aware of a personal data breach affecting Customer Personal Data, we will notify Customer without undue delay.

The notification will include available information reasonably necessary for Customer to assess the incident, taking into account the nature of the breach and the information available to us.

Customer is responsible for determining whether any notification to data subjects, regulators, customers, employees, or third parties is required.

13. Assistance to Customer

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to Customer with:

data subject rights requests;\ security obligations;\ personal data breach investigations;\ data protection impact assessments;\ regulatory inquiries related to processing performed by ETL Console.

Customer remains responsible for responding to data subjects and regulators where Customer acts as controller.

If assistance requires significant time, technical work, export, investigation, or custom support, it may be subject to reasonable fees unless prohibited by law or agreed otherwise.

14. Deletion and Return of Data

Customer may export available data and configurations where supported by the Platform before deleting an account or organization workspace.

When an account or organization workspace is deleted, we delete Customer assets and operational records associated with that account or organization, subject to the retention exceptions described below. These may include:

connections; mappings; staging configurations; transformation configurations; job configurations; rejected rows; related operational assets.

Application logs associated with deleted users are deleted within 14 days after the applicable account or organization deletion.

We may retain limited anonymized or pseudonymized records where reasonably necessary for:

trial abuse prevention; billing and subscription history; tax or accounting records; legal compliance; security; fraud prevention; dispute resolution; enforcement of agreements; legitimate business lifecycle analytics.

For trial abuse prevention, we may retain a non-plain normalized email hash or similar pseudonymous identifier.

Subscription and billing records may be retained where legally or commercially necessary, including provider identifiers, transaction references, plan history, invoice references, payment status, amounts, currency, and relevant dates.

Rejected rows are retained only according to Customer-configured retention settings and are automatically deleted after the configured period following job completion.

Backups may retain data for a limited period before automatic deletion according to backup cycles.

Where applicable data protection law requires return or deletion of Customer Personal Data following termination of processing services, we will delete or return such data in accordance with Customer’s instructions, unless applicable law requires continued retention.

15. Audit and Information Rights

We will make reasonable information available to demonstrate compliance with this DPA.

We may satisfy audit-related obligations by providing:

security documentation;\ policy summaries;\ technical descriptions;\ questionnaire responses;\ certifications or reports, if available;\ reasonable written explanations of relevant controls.

On-site audits, penetration tests, direct infrastructure reviews, or access to systems are not permitted unless separately agreed in writing and subject to confidentiality, security, scope, timing, and cost restrictions.

Audits must not compromise the security, confidentiality, availability, or privacy of the Service or other customers.

16. Sensitive Data

ETL Console is not specifically designed for processing highly sensitive categories of personal data unless Customer has ensured all required legal basis, safeguards, permissions, and compliance obligations.

Customer is responsible for determining whether any connected data requires additional safeguards, contractual terms, security controls, or regulatory approvals.

17. No Sale of Personal Data

We do not sell Customer Personal Data.

We do not use Customer source data to train AI models.

If AI features are introduced in the future, additional notices, terms, or settings may apply.

18. Liability

The limitations of liability in the Terms of Service apply to this DPA, unless prohibited by applicable law.

Nothing in this DPA limits liability where such limitation is not permitted by applicable law.

19. Term and Termination

This DPA remains in effect for as long as we process Customer Personal Data on behalf of Customer.

Upon termination of the Service or deletion of the relevant account or workspace, deletion, anonymization, retention, or return of Customer Personal Data will be handled according to this DPA, the Terms of Service, the Privacy Policy, and applicable retention settings.

Appendix 1 — Processing Details

Subject Matter

Provision of ETL Console, including connection management, metadata discovery, staging, transformations, job execution, troubleshooting, and related support.

Duration

For the duration of Customer’s use of the Service and any applicable retention period.

Nature of Processing

access;\ reading;\ temporary processing;\ display;\ analysis;\ transformation;\ staging;\ writing to customer-configured targets;\ storage of metadata and configurations;\ logging;\ troubleshooting;\ deletion;\ anonymization;\ pseudonymization where applicable.

Purpose of Processing

To provide, operate, secure, maintain, improve, and support ETL Console according to Customer’s instructions.

Categories of Personal Data

Customer determines the categories of personal data processed through the Platform. Depending on Customer’s data sources, this may include:

identifiers;\ contact data;\ transactional data;\ commercial data;\ professional data;\ technical identifiers;\ location data;\ database records;\ metadata;\ or any other personal data included in Customer-controlled sources.

Categories of Data Subjects

end users;\ employees;\ contractors;\ customers;\ suppliers;\ applicants;\ citizens;\ residents;\ business partners;\ or other individuals determined by Customer.

Appendix 2 — Technical and Organizational Measures

We apply reasonable technical and organizational measures appropriate to the nature of the Service, which may include:

Access Control

role-based access controls;\ workspace and organization permissions;\ restricted administrative access;\ least-privilege access principles;\ access only for authorized personnel with a business need.

Credential and Secret Protection

encryption of connection secrets at rest;\ password hashing for user passwords;\ restricted access to stored credentials;\ credentials not displayed back in plain text after saving where technically supported.

Transmission Security

HTTPS/TLS for supported hosted services;\ secure communication channels where available;\ reasonable protection against unauthorized interception.

Logging and Monitoring

application activity logs;\ job execution logs;\ security and error logs;\ monitoring for troubleshooting, abuse prevention, and service reliability.

Retention Controls

user-configured rejected row retention;\ default rejected row retention of 3 days;\ maximum rejected row retention of 30 days;\ automatic deletion of rejected rows after the configured period;\ deletion of user-related application logs within 14 days after account deletion;\ deletion or anonymization of operational account data according to retention rules.

Separation and Configuration

logical separation of user accounts, organizations, and workspaces;\ customer-controlled connections, mappings, staging jobs, and transformations;\ customer-selected target systems and destinations.

Backup and Recovery

backup procedures where applicable;\ limited backup retention according to backup cycles;\ recovery procedures designed to support service continuity.

Personnel and Confidentiality

access limited to authorized persons;\ confidentiality obligations for personnel with access to customer-related data;\ support access limited to troubleshooting, maintenance, security, and operation of the Service.