Standard Contractual Clauses — Annexes

Effective Date: 1 April 2026 Last Updated: 3 April 2026

These Annexes form part of the Data Processing Agreement between the Customer (Controller / Data Exporter) and GTMSAI Ltd (Processor / Data Importer), and complete the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor.

Where the Controller is established in the United Kingdom, the UK International Data Transfer Agreement (UK IDTA) Addendum set out in Part 2 of this document applies in addition.

Part 1: EU Standard Contractual Clauses (Module 2) — Annexes

ANNEX I

A. LIST OF PARTIES

Data Exporter (Controller):

Field	Value
Name	The Customer, as identified in the Service Agreement
Address	As specified in the Service Agreement
Contact person	The Customer's designated account administrator
Activities relevant to the transfer	Use of the Pebbles Ai platform for B2B go-to-market activities, including contact management, outreach campaign execution, AI-powered research, and email integration
Role	Controller

Data Importer (Processor):

Field	Value
Name	GTMSAI Ltd, trading as Pebbles Ai
Address	82 Wandsworth Bridge Road, London, United Kingdom, SW6 2TF
Contact person	Maksym Kuzmovych, Data Protection Officer — data@trypebbles.ai
Activities relevant to the transfer	Provision of the Pebbles Ai platform, including data hosting, AI-powered content generation, campaign execution, and email integration services
Role	Processor

B. DESCRIPTION OF TRANSFER

Field	Description
Categories of data subjects	The Controller's business contacts and prospects; recipients of the Controller's outreach campaigns; other individuals whose personal data is uploaded or processed through the Service by the Controller
Categories of personal data	Contact information (names, email addresses, telephone numbers, job titles, company names); professional information (LinkedIn profile data, business roles, industry information); communication content (email content, message drafts, campaign copy); engagement data (email open/click tracking, campaign response data); any other personal data that the Controller uploads to or processes through the Service
Sensitive data transferred	None intentionally. The Controller is responsible for ensuring that sensitive or special category data is not uploaded to the Service unless explicitly agreed. If the Controller connects a Google Workspace integration, email content may incidentally contain sensitive information — such data is processed solely to provide the requested functionality and is subject to the restrictions in Section 8 of the Privacy Policy.
Frequency of the transfer	Continuous, for the duration of the Service Agreement
Nature of the processing	Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (to sub-processors for service delivery), alignment, combination, restriction, erasure, and destruction — all as necessary to provide the Service
Purpose of the transfer	To enable the Processor to provide the Pebbles Ai platform services to the Controller, including: storing and managing contact lists; generating personalised outreach content using AI; executing email and messaging campaigns; providing AI-powered research and intelligence features; managing campaign analytics and performance reporting
Retention period	For the duration of the Service Agreement plus 30 days. Database backups are purged within 90 days of data deletion. Full details in the Data Retention and Deletion Policy.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is determined as follows:

Where the Data Exporter is established in the European Economic Area: the supervisory authority of the EU Member State in which the Data Exporter is established, in accordance with Clause 13 of the SCCs.
Where the Data Exporter is established in the United Kingdom: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk.
Where the Data Exporter is not established in the EEA or UK but is subject to EU GDPR (Article 3(2)): the Belgian Data Protection Authority (Autorité de protection des données), as the Processor's primary infrastructure is located in Belgium (europe-west1).

ANNEX II — TECHNICAL AND ORGANISATIONAL MEASURES

The Processor implements the following technical and organisational measures to ensure a level of security appropriate to the risk of processing. These measures are described in full in the Information Security Policy.

1. Encryption

Measure	Implementation
Encryption at rest	All data stored in Google Cloud SQL (PostgreSQL) is encrypted using AES-256 with Google-managed encryption keys. Google Cloud Storage uses AES-256 server-side encryption. Application secrets are stored in Google Secret Manager with IAM-controlled access.
Encryption in transit	All external communication uses TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled. Certificate validation is enabled on all connections. Inter-service communication within GKE uses mutual TLS where supported. Database connections use SSL (`sslmode=require`).
Cryptographic standards	Only industry-proven, government-approved cryptographic algorithms, modes, and libraries are used. No custom cryptographic implementations. Password hashing uses bcrypt, scrypt, or Argon2 with appropriate work factors.

2. Access Control

Measure	Implementation
Principle of least privilege	Users and service accounts are granted only the minimum permissions necessary. GCP IAM uses role-based access with predefined and custom roles per service. Kubernetes RBAC enforces namespace-scoped roles.
Multi-factor authentication	MFA is mandatory for all accounts, including Google Workspace, GCP Console, application admin panels, source code repositories, and any system with access to production data.
Access reviews	Access rights are reviewed quarterly. Access is revoked immediately upon role change or departure. Service account permissions are reviewed during each deployment cycle.
Password policy	Minimum 12 characters, complexity requirements (upper/lower case, number, special character), no reuse of last 5 passwords, dictionary check. Passphrases encouraged.

3. Network Security

Measure	Implementation
Infrastructure	Google Cloud Platform (GCP) in europe-west1 (Belgium). Google Kubernetes Engine (GKE) with multi-zone clusters. VPC with private networking. Cloud Armor WAF.
DDoS protection	Cloudflare CDN and DDoS protection for edge traffic.
CORS	Configured with specific allowed origins (not wildcard). Allowed methods and headers explicitly enumerated.
Security headers	HTTP responses include: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, Referrer-Policy, Permissions-Policy.

4. Logging and Monitoring

Measure	Implementation
Security event logging	Authentication events, OAuth events, access control failures, data modification events, administrative actions, and security incidents are logged in structured JSON format.
Log contents	Timestamp (UTC), user ID, event type, success/failure, source IP, resource affected, error code. Logs never contain passwords, tokens, or credentials.
Log retention	Security event logs: 90 days online. Audit logs: 1 year archived. Application logs: 30 days online.
Monitoring	Automated alerting for repeated authentication failures, privilege escalation attempts, and abnormal API usage. Log aggregation via Google Cloud Logging.

5. Incident Response

Measure	Implementation
Incident response plan	Documented eight-step procedure (detect, contain, assess, Google data check, investigate, communicate, remediate, post-incident review). Full details in the Incident Response Policy.
Response times	Critical: 15 minutes. High: 1 hour. Medium: 4 hours. Low: 24 hours.
Breach notification	Supervisory authority within 72 hours (GDPR). Affected individuals without undue delay where high risk. Google immediately for Google user data. Controller without undue delay for customer-uploaded data.
Evidence preservation	Forensic evidence retained for minimum 3 years. Chain of custody maintained. Access-restricted storage.

6. Secure Development

Measure	Implementation
Code review	All code changes require peer review. Security-sensitive changes require senior engineer or Security Officer review.
Input validation	Server-side validation of all untrusted input. Parameterised database queries. Context-aware output encoding.
Dependency management	Third-party dependencies monitored for vulnerabilities. Remediation SLAs: Critical 48h, High 7 days, Medium 30 days, Low next release.
Security scanning	SAST (Fluid Attacks), DAST (OWASP ZAP), dependency audit, secrets scanning.

7. Data Protection

Measure	Implementation
Data minimisation	Only data elements strictly necessary for enabled features are accessed and retained.
Data retention	Defined retention periods per data type. Automated deletion. 30-day account deletion, 90-day backup purge. Full schedule in the Data Retention and Deletion Policy.
Data export	Users can export their data in structured, machine-readable format (JSON, CSV) via in-app settings or email request.
Backup security	Cloud SQL automated backups encrypted at rest. Access restricted to DevOps Lead and Security Officer. Selective restoration of individual user data from backups is prohibited.

8. Personnel

Measure	Implementation
Confidentiality	All personnel authorised to process personal data are bound by confidentiality obligations.
Training	Annual security awareness training. Incident reporting procedures included in onboarding.
Background checks	Conducted as permitted by applicable law for personnel with access to production systems.

9. Sub-processor Management

Measure	Implementation
Due diligence	Security assessment of all sub-processors before engagement.
Contractual safeguards	Data processing agreements with all sub-processors imposing obligations substantially equivalent to this DPA.
Notification	30 days advance written notice before engaging new sub-processors. Objection mechanism with termination right.
Monitoring	Ongoing monitoring of sub-processor compliance.

ANNEX III — LIST OF SUB-PROCESSORS

The Controller authorises the engagement of the following sub-processors. The current list is maintained at Subprocessor List and is incorporated here by reference.

Infrastructure & Platform Services

Sub-processor	Processing Activity	Location
Google Cloud Platform	Infrastructure hosting (compute, storage, databases)	Belgium (europe-west1)
Cloudflare	CDN, DDoS protection, bot management	Global (edge network)
Stripe	Payment processing	US / EU
SendGrid	Email delivery for campaigns	US
HubSpot	Sales CRM, marketing automation	US (EU data centre available)
Sentry	Error tracking and performance monitoring	US
Pusher	Real-time message delivery (WebSocket) for AI content streaming	EU (Ireland)
Weaviate	Vector database for AI search and retrieval (Weaviate Cloud)	Germany (europe-west3, Frankfurt)

AI/LLM Service Providers

Sub-processor	Processing Activity	Location
Anthropic	AI language model (Claude) — copilot and content generation	US
OpenAI	AI language model (GPT) — copilot and content generation	US
Google Cloud Vertex AI	AI language model (Gemini) — copilot and content generation	US (migration to europe-west1 planned)
xAI	AI language model (Grok) — copilot and content generation	US
Perplexity AI	AI-powered research and information retrieval	US

Analytics (Website Only)

Sub-processor	Processing Activity	Location
Google Analytics	Website usage analytics	US
Microsoft Clarity	User behaviour analytics (heatmaps, session replays)	US

Internal Operations (No Customer Personal Data)

Sub-processor	Processing Activity	Location
Google Workspace	Internal business operations	EU
GitHub	Source code hosting	US
Slack	Internal communications	US

Note: GitHub and Slack do not process customer personal data in the ordinary course of providing the Service. They are listed for transparency.

For each sub-processor located outside the EEA or UK, appropriate safeguards are in place, including Standard Contractual Clauses and/or adequacy decisions. See Subprocessor List for full details including data types processed.

Part 2: UK International Data Transfer Agreement (IDTA) Addendum

This Addendum is issued under Section 119A of the Data Protection Act 2018 and supplements the EU Standard Contractual Clauses referred to in Part 1 of this document. It applies where the Data Exporter is established in the United Kingdom or where the transfer is otherwise subject to UK data protection law.

Table 1: Parties

Field	Value
Start date	The effective date of the Service Agreement
Exporter	The Customer (Controller), as identified in the Service Agreement
Importer	GTMSAI Ltd, 82 Wandsworth Bridge Road, London, SW6 2TF
Exporter contact	The Customer's designated account administrator
Importer contact	Maksym Kuzmovych, DPO — data@trypebbles.ai
Exporter role	Controller
Importer role	Processor

Table 2: Selected SCCs, Modules and Clauses

Field	Value
Addendum EU SCCs	The EU SCCs adopted by Commission Implementing Decision (EU) 2021/914, as completed by the Annexes in Part 1 of this document
Module	Module 2: Controller to Processor
Clauses	All clauses of Module 2 apply
Optional Clause 7 (Docking clause)	Included — additional data exporters may accede to the SCCs with the agreement of the existing parties
Clause 9(a) Option	Option 2: General written authorisation. The Importer shall inform the Exporter of any intended changes to the list of sub-processors, giving the Exporter the opportunity to object in accordance with Section 5 of the DPA.
Clause 11(a) (Redress)	The optional language is not included
Clause 17 (Governing law)	The laws of England and Wales
Clause 18(b) (Forum)	The courts of England and Wales

Table 3: Appendix Information

The Appendix Information for the purposes of the UK IDTA Addendum is set out in the Annexes in Part 1 of this document:

Annex I(A): List of Parties
Annex I(B): Description of Transfer
Annex I(C): Competent Supervisory Authority (ICO for UK transfers)
Annex II: Technical and Organisational Measures
Annex III: List of Sub-processors

Table 4: Ending This Addendum

Neither party may end this Addendum in accordance with Section 19 of the UK IDTA Addendum. The Addendum remains in force for the duration of the Service Agreement and survives termination to the extent necessary to give effect to the data protection obligations in the DPA.

Amendments

This document may only be amended in writing, signed by both parties, in accordance with Section 12.2 of the Data Processing Agreement.

Contact

GTMSAI Ltd (trading as Pebbles Ai) 82 Wandsworth Bridge Road, London, United Kingdom, SW6 2TF

Data Protection Officer: data@trypebbles.ai