Ecosystem Data Processing Framework (DPA)

1. Parties

This Ecosystem Data Processing Framework (DPA) is executed between:

Data Controller (Participant / Organization) — the Access Key Holder participating in the EclipsiumX ecosystem
Data Processor (Ecosystem Provider) — EclipsiumX SRL

CUI: 53832723 EUID: ROONRC.J2026008520009 Sediu: Lunca Banului, Jud. Vaslui, Romania Email: [email protected]

2. Subject & Scope of Processing

The Processor provides identity authentication, operational environments, automated workflows, and intelligence infrastructure across the 9 canonical Verses: TransportVerse, BusinessVerse, AurionX, LexiVerse, InfrastructureVerse, TransmissionVerse, WebVerse, ITVerse, and MarketingVerse under UniversePass. Personal data and operational telemetry are processed strictly as necessary to deliver these ecosystem services.

3. Categories of Processed Data

The Processor handles:

• Identity Layer authentication data (SSO tokens, Participant credentials, Access Key scopes)
• UniversePass access metrics and tier status (Essentials, Pro, Infinity)
• Operational World telemetry and environment configuration states
• AurionX intelligence interaction context parameters and query logs
• TransmissionVerse message metadata and routing logs
• Billing and transaction data (Access Key invoices, payment reference tokens)

4. Duration of Processing

Data is processed for the active duration of the Participant's UniversePass Access Key activation. Upon Access Key deactivation or exit, personal data is retained only for the designated export window, after which it is deleted or anonymized unless statutory retention obligations apply.

5. Processor Obligations

EclipsiumX SRL agrees to:

• Process personal data exclusively on documented instructions from the Data Controller
• Enforce strict personnel confidentiality agreements across all ecosystem operations
• Implement robust technical and organizational security controls across the Security Shield
• Assist the Data Controller in fulfilling GDPR data subject access and privacy requests
• Notify the Data Controller of any personal data breach without undue delay
• Permanently delete or return personal data upon Access Key termination

6. Controller Obligations

The Data Controller agrees to:

• Maintain a valid legal basis under GDPR for all data ingested into Operational Worlds
• Provide accurate, lawful processing instructions to the ecosystem
• Safeguard UniversePass Access Keys and Identity Layer credentials
• Refrain from transmitting unlawful or malicious content across ecosystem nodes

7. Sub-Processors & Partners

The Processor utilizes audited sub-processors for infrastructure, security, payment processing, and message routing, including:

• InfrastructureVerse datacenter providers
• Cloudflare (Security & CDN edge nodes)
• Stripe & PayPal (Payment processing infrastructure)
• TransmissionVerse edge delivery nodes

All sub-processors are bound by data protection agreements aligned with GDPR Article 28 standards.

8. Security Controls & Encryption

The Processor implements:

• TLS 1.3 encryption in transit and AES-256 encryption at rest
• Network isolation firewalls and automated DDoS mitigation
• Identity Layer multi-factor authentication and role-based access controls
• Isolated runtime environments for Operational Worlds
• Automated security logging and anomaly detection

9. Data Breach Notification

In the event of a confirmed personal data breach affecting ecosystem data, the Processor will transmit a notification to the Controller without undue delay via the Transmissions layer, specifying the breach scope, potential impacts, and mitigation measures.

10. Data Subject Rights

The Processor assists the Controller in responding to GDPR data subject requests regarding access, rectification, erasure, restriction, portability, and objection across all Operational Worlds.

11. Deactivation & Exit Data Handling

Upon termination of UniversePass Access Keys, the Processor deletes or returns all personal data according to the Access Key Exit Protocol, unless statutory retention obligations apply.

12. Governing Law

This DPA is governed by the laws of Romania and European Union law (GDPR).