ONIBEX, INC. Client Data Processing Policy

Last Updated: August 2026

This Client Data Processing Policy describes how ONIBEX, INC. ("Onibex," "we," "us," or "our") processes data on behalf of its clients through its integration and technology platforms, including OneConnect, Smart Gateway, and ASK (collectively, the "Platforms"). This policy applies to data processed in the course of delivering contracted services and is separate from our Website Privacy Policy, which governs information collected from visitors to onibex.com.

1. Scope and Roles

In the course of providing SAP integration, data streaming, and related services, Onibex may process data that originates from a client's systems, including SAP environments, and that flows through the Platforms to destinations such as Kafka/Confluent topics, Databricks, PostgreSQL, or other systems designated by the client.

For purposes of this policy, the client is the data controller (or equivalent role under applicable law) with respect to any personal or business data contained within its own systems, and Onibex acts as a data processor or service provider, processing such data solely on the client's documented instructions and for the purpose of delivering the contracted services. Onibex does not use client data for any purpose other than providing, maintaining, and improving the contracted services, unless otherwise agreed in writing.

2. Types of Data Processed

The specific data processed through the Platforms depends entirely on each client's configuration and use case, and may include business transactional data, master data, and, where present in the client's source systems, personal data relating to the client's employees, customers, or vendors. Onibex does not control or review the content of client source data beyond what is necessary to configure and operate the integration.

3. Purpose of Processing

Data is processed for the purposes of: extracting, transforming, and synchronizing data between SAP systems and target destinations in real time or near real time; enabling data streaming pipelines; supporting analytics, reporting, and AI-driven use cases through platforms such as Databricks; and any other purpose specifically agreed with the client in the applicable service agreement or statement of work.

4. Data Flow and Infrastructure

Depending on the deployment model selected by the client (SaaS, Bring Your Own Cloud, or on-premise), data may be processed and transmitted through cloud infrastructure, including AWS, Azure, or Google Cloud Platform, and may pass through components such as Kafka/Confluent topics, Databricks workspaces and Unity Catalog, and intermediate storage layers. The specific architecture and data residency for each client's environment are defined in the applicable statement of work or technical documentation.

5. Subprocessors

Onibex may engage subprocessors, including cloud infrastructure providers and data streaming or analytics platform providers, to support the delivery of services. Onibex remains responsible for the acts and omissions of its subprocessors to the same extent as if performed directly by Onibex. Onibex's current subprocessors include Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform, Confluent, and Databricks.

6. Security Measures

Onibex implements administrative, technical, and organizational measures designed to protect client data, including but not limited to: encryption of data in transit and, where applicable, at rest; role-based access controls and permission management (including Unity Catalog and token-based authentication); network segmentation; and monitoring of access and system activity. Access to client data is restricted to authorized personnel who require such access to perform the contracted services.

7. Data Retention and Deletion

Onibex retains client data only for as long as necessary to provide the contracted services or as otherwise instructed by the client. Upon termination of the applicable service agreement, Onibex will delete or return client data in accordance with the terms agreed with the client, unless retention is required by applicable law.

8. International Data Transfers

Onibex operates with teams and infrastructure across multiple countries, including the United States, Mexico, Colombia, El Salvador, Ecuador, Indonesia, and China. As a result, client data may be accessed or processed by personnel located in these jurisdictions in connection with service delivery. Where required by applicable law, Onibex will implement appropriate safeguards for such international transfers.

9. Client Responsibilities

The client remains responsible for: ensuring it has a valid legal basis for the collection and processing of any personal data contained within the data it provides to Onibex; classifying and identifying any sensitive or regulated data prior to integration; and providing Onibex with accurate instructions regarding the handling of such data.

10. Incident Response and Breach Notification

In the event Onibex becomes aware of a security incident affecting client data processed through the Platforms, Onibex will notify the affected client without undue delay and will cooperate with the client's reasonable requests to investigate and remediate the incident, consistent with the terms of the applicable service agreement.

11. Confidentiality

Onibex treats all client data processed through the Platforms as confidential information and will not disclose it to third parties except: as necessary to provide the contracted services, as authorized in writing by the client, or as required by law.

12. Relationship to Service Agreements

Where a specific service agreement, statement of work, or Data Processing Addendum has been executed between Onibex and a client, the terms of that agreement shall govern in the event of any conflict with this policy.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, infrastructure, or legal requirements. Changes will be posted with an updated "Last Updated" date.

14. Contact Us

For questions about this Client Data Processing Policy, please contact us at:

ONIBEX, INC.
Attention: Internet Customer Service
21 Waterway Avenue, Suite 300
The Woodlands, TX 77380, USA