Data processing agreement “Polars Nanook”

This Data Processing Agreement (the “DPA”) forms part of the Terms of Use for Polars Nanook between Polars B.V. (“Polars”, the processor) and the Customer (the controller). It applies to personal data that Polars processes on behalf of the Customer (the “Personal Data”): (a) personal data contained in query plans and query profiles that Polars stores on the Control Plane to make them available to the Customer; (b) personal data in Customer Data that Polars processes through Serverless under clause 13 of the Terms; and (c) personal data in Catalog Data, including statistics, that Polars stores or receives under clause 14 of the Terms. Capitalised words have the meaning given in the Terms. Terms defined in the GDPR have the meaning given there.

1. SCOPE AND ROLES

1.1. This DPA does not apply to processing for which Polars is controller under clause 9.1 of the Terms, such as Account information and usage data for billing, security, support and improvement of the Service. Authorised Polars personnel may access query plans and query profiles to operate, secure and support the Service. Polars uses them to improve the Service only in aggregated or de-identified form.

1.2. The Customer is responsible for the lawfulness of the processing and its instructions, including a legal basis, notices to data subjects, the configuration of the Service, the choice of the regions of its data sources, and the access and credentials it grants to Serverless and the Data Catalog.

2. INSTRUCTIONS

2.1. Polars processes the Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration and use of the Service are the Customer’s instructions, including on transfers.

2.2. Polars informs the Customer if it considers an instruction to infringe the GDPR, and may suspend that instruction until the Customer confirms or changes it. Polars has no obligation to screen the Customer’s data or instructions otherwise.

2.3. Polars may process the Personal Data otherwise only where required by EU or Member State law, in which case Polars informs the Customer before processing unless that law prohibits it.

3. CONFIDENTIALITY AND SECURITY

3.1. Polars ensures that persons authorised to process the Personal Data are bound by confidentiality.

3.2. Polars implements the technical and organisational measures set out in Annex 2, as required by Article 32 GDPR. Polars may update these measures provided the overall level of protection is not reduced.

4. SUB-PROCESSORS

4.1. The Customer gives Polars general authorisation to engage sub-processors. The current sub-processors, with their purpose and location, are listed at https://pola.rs/legal/sub-processors.

4.2. Polars informs the Customer of an intended new or replacement sub-processor by email to the Account email address at least fourteen (14) days in advance. The Customer may object on reasonable data protection grounds within ten (10) days of the notice; otherwise the change is accepted. If the parties cannot resolve an objection within thirty (30) days, the Customer may terminate its Account or stop using Serverless or the Data Catalog as its sole remedy. Where a replacement is urgently needed for security or continuity, Polars may engage it immediately and inform the Customer promptly.

4.3. Polars imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to the Customer for its sub-processors’ performance.

5. TRANSFERS

5.1. Query plans and query profiles are stored on the Control Plane, which is hosted in the United States. Catalog Data that Polars receives is processed in the United States or in the AWS region of the Customer’s data source. Customer Data processed through Serverless is processed in the AWS region of the Customer’s data source, which the Customer chooses; where that region is outside the European Economic Area, the Customer instructs that transfer.

5.2. Polars ensures that transfers to sub-processors outside the European Economic Area are covered by an adequacy decision, including the EU-US Data Privacy Framework where applicable, or by the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), and provides the relevant documentation on request.

5.3. Where the Customer is established outside the European Economic Area and is not subject to the GDPR, Module Four of those Standard Contractual Clauses applies to transfers from Polars to the Customer and is incorporated by reference, with the details in Annex 1 and the laws and courts of the Netherlands.

6. GOVERNMENT ACCESS

6.1. If a public authority requests access to Personal Data, Polars redirects the request to the Customer where possible, informs the Customer before disclosing unless legally prohibited, challenges requests it considers unlawful, and discloses only the minimum required.

7. ASSISTANCE

7.1. The Customer can access, export and delete Personal Data through the Service. Beyond that, Polars assists the Customer, through support@polars.tech, in responding to requests from data subjects and with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments. Polars forwards to the Customer any request it receives directly from a data subject. Polars may charge reasonable costs for assistance beyond the functionality of the Service, unless the request results from Polars’ breach of this DPA.

8. PERSONAL DATA BREACHES

8.1. Polars notifies the Customer by email to the Account email address without undue delay and, where feasible, within forty-eight (48) hours after becoming aware of a personal data breach affecting the Personal Data. To the extent known, the notice describes the nature of the breach, the categories of data concerned, the likely consequences and the measures taken. Unsuccessful attempts that do not compromise the Personal Data are not breaches. A notice is not an acknowledgement of fault.

9. RETURN AND DELETION

9.1. The Customer may export its query history and retrieve Temporary Results through the Service at any time before termination. Polars deletes query plans and query profiles at the end of the retention period of the Customer’s Plan, Personal Data processed through Serverless as set out in clause 13 of the Terms, and Catalog Data as set out in clause 14 of the Terms. After termination of the Account, Polars deletes the remaining Personal Data, including backups in line with its backup cycle, unless EU or Member State law requires storage. Polars confirms deletion on request.

10. AUDITS

10.1. Polars makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, primarily through its security documentation and independent audit reports, where available. Where these are not sufficient, the Customer may carry out an audit, including an inspection, by itself or through an independent auditor that is not a competitor of Polars and is bound by confidentiality, once per year with at least thirty (30) days’ notice, at its own cost and without disrupting Polars’ operations. These limits do not apply where a supervisory authority requires the audit. Audit results are Polars’ Confidential Information.

11. GENERAL

11.1. Clause 11 of the Terms applies to this DPA, except to the extent prohibited by the Standard Contractual Clauses or applicable law.

11.2. In case of conflict on the processing of the Personal Data, this DPA prevails over the Terms.

11.3. Polars notifies changes to this DPA by email to the Account email address at least fourteen (14) days before they take effect. If the Customer does not accept a change, it may terminate its Account before the change takes effect.

11.4. This DPA ends when Polars no longer processes Personal Data for the Customer.

ANNEX 1: DESCRIPTION OF THE PROCESSING

Special categories of personal data: the Customer shall not include them in query plans or Catalog Data, or process them through Serverless, unless agreed in writing.

Contact for data protection: info@polars.tech.

ANNEX 2: TECHNICAL AND ORGANISATIONAL MEASURES

Polars maintains an information security programme, documented in policies that management reviews at least annually, covering:

• access control: unique accounts, access limited to what a role requires, removal of access when personnel leave;
• logical separation of customers’ data;
• encryption of Personal Data in transit and at rest;
• logging and monitoring of system activity;
• vulnerability management, including scanning and remediation;
• incident response, including notification under clause 8;
• backups and business continuity;
• confidentiality obligations and security awareness for personnel;
• security requirements for sub-processors.

Polars’ security programme is audited under SOC 2; the current report and further information are available at https://trust.pola.rs. Polars may update these measures in accordance with clause 3.2.

Effective date: 5 November 2026

[OPEN — remove before publication]

• Annex 2 trimmed 28 Oct 2026 to the topics of the approved Drata policies. One check for engineering: encryption at rest (Drata control DCF-54 has no evidence yet). trust.pola.rs not live yet.
• Data Catalog: before Polars hosts a catalog, notify its location under 11.3. If Catalog Data is ever processed outside the locations in 5.1, update 5.1 and Annex 1 first.
• Lawyer to confirm: the dual controller and processor role; Module Four wording for customers outside the EEA (5.3); interaction of 9.1 with the Data Act retrieval period; whether a CCPA (US state law) annex is needed for US customers.