Data Processing Addendum

Article 1. Definitions

1.1. For the purposes of this Addendum, the following terms shall have the meanings set forth below.

a. "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Compuvi on behalf of the Customer under this Addendum.

b. "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.

c. "Sub-processor" means any third-party service provider engaged by Compuvi to process Personal Data on behalf of the Customer in connection with the services provided under the primary agreement.

d. "Applicable Data Protection Laws" means all laws, regulations, and regulatory requirements relating to the protection of Personal Data that apply to the Parties, including the General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and any other relevant privacy legislation.

e. "Data Subject" means the individual to whom the Personal Data relates and whose rights are protected under Applicable Data Protection Laws.

f. "Data Breach" means any unauthorized or unlawful access to, acquisition of, disclosure of, alteration of, or destruction of Personal Data in Compuvi's possession or control.

g. "Standard Contractual Clauses" means the contractual clauses adopted by the European Commission or other regulatory authorities for the lawful transfer of Personal Data to countries outside the European Economic Area that do not provide an adequate level of data protection.

h. "Technical and Organizational Measures" means the security controls, protocols, and practices implemented by Compuvi to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage.

i. "Controller" means the party that determines the purposes and means of Processing Personal Data. For purposes of this Addendum, the Customer acts as the Controller.

j. "Processor" means the party that processes Personal Data on behalf of the Controller. For purposes of this Addendum, Compuvi acts as the Processor.

Article 2. Scope and Purpose of Processing

2.1. Compuvi shall process Personal Data solely for the purpose of providing the services described in the primary agreement between the Parties, including any ancillary functions that are necessary to support the delivery, optimization, security, or performance of the Confinaid platform. Such Processing shall at all times be performed only on documented instructions from the Customer, except where otherwise required by Applicable Data Protection Laws.

2.2. The types of Personal Data processed under this Addendum may include, but are not limited to, identification details, contact information, transactional records, regulatory compliance inputs, and other data that may be required to facilitate the lawful and effective use of the platform by the Customer. The categories of Data Subjects whose information may be processed include Customer personnel, end-users of the Customer's services, regulatory contacts, or other individuals whose data is provided or collected in the course of using Confinaid.

2.3. The Processing activities covered by this Addendum are limited to those necessary to enable Compuvi to fulfil its obligations as a Processor. No Personal Data will be processed for independent purposes or in any manner inconsistent with the Customer's lawful instructions, unless such Processing is required by law. In such cases, Compuvi shall inform the Customer of the legal requirement before processing, unless prohibited from doing so by law.

Article 3. Roles and Responsibilities of the Parties

3.1. The Parties acknowledge and agree that, for the purposes of this Addendum and as required under Applicable Data Protection Laws, the Customer acts as the Controller and Compuvi acts as the Processor of Personal Data. The Customer determines the purposes and means of Processing, while Compuvi processes Personal Data solely on behalf of, and in accordance with, the lawful instructions of the Customer.

3.2. The Customer shall be solely responsible for ensuring that the Personal Data it provides or makes available to Compuvi has been collected and disclosed in accordance with all applicable legal requirements, including obtaining any necessary consents or providing required notices to Data Subjects. The Customer also represents that it has the lawful authority to transmit or otherwise make Personal Data available to Compuvi for the purposes stated in this Addendum.

3.3. Compuvi shall perform its duties as a Processor with due care, diligence, and in full compliance with the Customer's documented instructions, this Addendum, the primary service agreement, and Applicable Data Protection Laws. Compuvi shall not process Personal Data for any purpose other than those specifically set out in this Addendum or the Customer's instructions, unless required to do so by law. In such cases, Compuvi shall promptly notify the Customer of that legal requirement unless the law prohibits such disclosure.

Article 4. Instructions from the Controller

4.1. Compuvi shall process Personal Data only on the basis of documented instructions provided by the Customer. Such instructions may be communicated through written agreements, secure communication channels, or platform settings that reflect the Customer's choices regarding data handling. Compuvi shall not deviate from these instructions unless such Processing is required by Applicable Data Protection Laws, in which case Compuvi shall inform the Customer of the legal obligation before proceeding, unless prohibited from doing so by law.

4.2. If Compuvi believes that any instruction from the Customer may violate Applicable Data Protection Laws or is otherwise unclear or impracticable, Compuvi shall promptly notify the Customer and request clarification or confirmation before continuing with the Processing activity in question. Compuvi shall not be required to follow any instruction that would result in a violation of law or a breach of this Addendum.

4.3. The Customer agrees that it will not instruct Compuvi to process Personal Data in a manner that would cause either Party to be in violation of Applicable Data Protection Laws. Compuvi shall not be liable for any Processing that is carried out in good faith reliance on instructions received from the Customer.

Article 5. Confidentiality of Processing

5.1. Compuvi shall ensure that any person acting under its authority, including employees, contractors, agents, or other representatives who are authorized to process Personal Data on behalf of the Customer, is subject to a duty of confidentiality. Such individuals shall be informed of the confidential nature of the Personal Data and shall receive appropriate training regarding their obligations under this Addendum and Applicable Data Protection Laws.

5.2. Compuvi shall take commercially reasonable steps to ensure that access to Personal Data is limited to those individuals who require access in order to perform their assigned duties in connection with the services provided to the Customer. Compuvi shall maintain internal policies and practices to uphold confidentiality obligations throughout the duration of the Processing.

5.3. This obligation of confidentiality shall survive the termination or expiration of this Addendum and shall continue to apply for as long as Compuvi retains any Personal Data on behalf of the Customer.

Article 6. Security Measures

6.1. Compuvi shall implement and maintain appropriate Technical and Organizational Measures designed to ensure a level of security appropriate to the risk associated with the Processing of Personal Data. These measures shall include, where relevant, safeguards relating to the confidentiality, integrity, availability, and resilience of systems and services used in the Processing of Personal Data.

6.2. Such measures may include, but are not limited to, access controls, encryption, network security, vulnerability management, user authentication protocols, intrusion detection systems, and policies for secure development and operation. Compuvi shall regularly review, test, and update its security measures to ensure ongoing effectiveness in accordance with industry standards and Applicable Data Protection Laws.

6.3. The Customer acknowledges that the security measures implemented by Compuvi take into account the nature, scope, context, and purposes of Processing, as well as the risks of varying likelihood and severity to the rights and freedoms of Data Subjects. Compuvi shall, upon reasonable request, provide the Customer with relevant information regarding its security practices in order to demonstrate compliance with this section.

Article 7. Sub-processors

7.1. The Customer acknowledges and agrees that Compuvi may engage Sub-processors to perform specific Processing activities on behalf of the Customer, provided that such engagement is in accordance with this Addendum and Applicable Data Protection Laws. Compuvi shall maintain a current list of Sub-processors used in connection with the services and shall make this list available to the Customer upon request.

7.2. Before engaging any new Sub-processor, Compuvi shall ensure that the Sub-processor is contractually bound by written obligations that provide at least the same level of protection for Personal Data as those set forth in this Addendum. Compuvi shall remain fully responsible for the performance of each Sub-processor and for any acts or omissions of such Sub-processor that may cause Compuvi to breach any of its obligations under this Addendum.

7.3. Where required by law or at the request of the Customer, Compuvi shall provide reasonable advance notice of any intended changes concerning the addition or replacement of Sub-processors, giving the Customer an opportunity to object to such changes. If the Customer reasonably objects, the Parties shall work in good faith to resolve the matter in a commercially reasonable manner.

Article 8. Data Subject Rights

8.1. Compuvi shall, to the extent legally permitted and reasonably practicable, assist the Customer in fulfilling its obligations to respond to requests from Data Subjects seeking to exercise their rights under Applicable Data Protection Laws. These rights may include requests for access to, correction of, restriction of, deletion of, or objection to the Processing of Personal Data, as well as requests for data portability or withdrawal of consent.

8.2. If Compuvi receives a request directly from a Data Subject in relation to Personal Data processed on behalf of the Customer, Compuvi shall promptly notify the Customer and shall not respond to the request except on the documented instructions of the Customer or as otherwise required by law. Compuvi shall maintain internal procedures to handle such requests in a secure and timely manner.

8.3. The Customer shall be responsible for ensuring that its use of the Confinaid platform includes appropriate notices and mechanisms to enable Data Subjects to exercise their rights in accordance with Applicable Data Protection Laws. Compuvi's role shall be limited to supporting the Customer's compliance efforts through reasonable and documented cooperation.

Article 9. Data Breach Notification

9.1. In the event that Compuvi becomes aware of a Data Breach involving Personal Data processed on behalf of the Customer, Compuvi shall notify the Customer without undue delay and, where feasible, no later than seventy-two hours after becoming aware of the breach. Such notification shall include, to the extent available, a description of the nature of the breach, the categories and approximate number of affected Data Subjects, the likely consequences of the breach, and the measures taken or proposed to address and mitigate its effects.

9.2. Compuvi shall promptly investigate the Data Breach and take appropriate steps to contain, remediate, and minimize any adverse impact. Compuvi shall keep the Customer informed of material developments related to the investigation and shall provide reasonable cooperation and assistance to the Customer in fulfilling its own obligations under Applicable Data Protection Laws, including any requirements to notify supervisory authorities or affected Data Subjects.

9.3. Except as required by law, Compuvi shall not disclose the existence or details of any Data Breach to any third party without the prior written consent of the Customer. The obligations set forth in this section shall apply regardless of the cause or origin of the breach and shall continue for as long as Compuvi retains or has access to Personal Data on behalf of the Customer.

Article 10. International Data Transfers

10.1. In the course of providing the services, Compuvi may transfer Personal Data to jurisdictions outside the country in which the Customer or Data Subjects are located. Where such transfers occur, Compuvi shall ensure that appropriate safeguards are in place to protect the Personal Data in accordance with Applicable Data Protection Laws.

10.2. Such safeguards may include reliance on adequacy decisions issued by relevant authorities, the use of standard contractual clauses approved by regulatory bodies, or other lawful transfer mechanisms recognized under Applicable Data Protection Laws. Compuvi shall not engage in cross-border transfers of Personal Data without a valid legal basis and shall maintain documentation of the transfer mechanism used.

10.3. Upon the Customer's request, Compuvi shall provide reasonable information regarding the countries to which Personal Data is transferred and the safeguards applied to such transfers. If required by law or regulatory guidance, Compuvi shall cooperate with the Customer to implement supplementary measures to ensure the continued protection of Personal Data transferred outside the relevant jurisdiction.

Article 11. Data Retention and Deletion

11.1. Upon the termination or expiration of the services under the primary agreement, or upon the written instruction of the Customer at any time, Compuvi shall, at the Customer's choice, either return all Personal Data processed on behalf of the Customer or securely delete such data from its systems and storage environments. Where applicable, Compuvi shall also ensure that any Sub-processors delete or return Personal Data in accordance with this obligation.

11.2. Compuvi may retain copies of Personal Data only to the extent required by Applicable Data Protection Laws or other legal obligations, and solely for the duration and purposes of such legal retention requirements. In such cases, Compuvi shall continue to protect the retained data in accordance with the terms of this Addendum.

11.3. Compuvi shall certify to the Customer, upon request, that the return or deletion of Personal Data has been completed in accordance with this section. This obligation shall apply regardless of the reason for termination or withdrawal of services.

Article 12. Audit Rights and Compliance Monitoring

12.1. Compuvi shall make available to the Customer, upon written request, all information reasonably necessary to demonstrate compliance with the obligations set forth in this Addendum and with Applicable Data Protection Laws. Compuvi shall also allow for and contribute to audits, including inspections conducted by the Customer or an independent auditor mandated by the Customer, provided that such audits are conducted in a manner that minimizes disruption to Compuvi's business operations.

12.2. The Customer shall provide reasonable advance notice of any audit, and the Parties shall mutually agree on the scope, timing, and method of the audit. Audits shall be limited to those systems, facilities, personnel, and documentation directly relevant to the Processing of Personal Data on behalf of the Customer.

12.3. If the Customer reasonably believes that Compuvi is not complying with its obligations under this Addendum or Applicable Data Protection Laws, Compuvi shall promptly cooperate to address such concerns. Compuvi may charge the Customer a reasonable fee for audits that exceed standard compliance support, provided such fees are pre-approved by the Customer.

Article 13. Liability and Indemnification

13.1. Each Party shall be responsible for its own acts and omissions under this Addendum and under Applicable Data Protection Laws. Compuvi shall be liable to the Customer for damages arising from a breach of its obligations under this Addendum only to the extent that such breach results directly from Compuvi's failure to comply with its documented instructions or applicable legal requirements.

13.2. The Customer agrees to indemnify, defend, and hold harmless Compuvi, its officers, employees, and agents from and against any claims, losses, liabilities, or expenses arising out of or in connection with (i) any Processing activity performed by Compuvi in accordance with the Customer's instructions, or (ii) the Customer's failure to comply with its obligations under this Addendum or Applicable Data Protection Laws.

13.3. Neither Party shall be liable to the other for any indirect, incidental, special, or consequential damages arising under this Addendum, except to the extent prohibited by law. Nothing in this section shall limit or exclude any liability that cannot be limited or excluded under Applicable Data Protection Laws.

Article 14. Term and Termination

14.1. This Addendum shall remain in effect for as long as Compuvi processes Personal Data on behalf of the Customer under the terms of the principal agreement or until this Addendum is terminated in accordance with its terms. Termination of the primary agreement shall automatically result in the termination of this Addendum, unless otherwise agreed in writing by the Parties.

14.2. Either Party may terminate this Addendum by providing written notice to the other if the other Party is in material breach of its obligations under this Addendum and fails to remedy such breach within a reasonable period following written notice. Termination of this Addendum shall not relieve either Party of its obligations that, by their nature, are intended to survive termination, including but not limited to those relating to confidentiality, liability, and data return or deletion.

14.3. Upon termination, Compuvi shall proceed in accordance with Section 11 of this Addendum concerning the return or deletion of Personal Data. The rights and remedies of the Parties under this Addendum shall be cumulative and in addition to any other rights and remedies available under law or contract.

Article 15. Governing Law and Jurisdiction

15.1. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. Any disputes arising out of or in connection with this Addendum shall be subject to the exclusive jurisdiction of the state and federal courts located in Dover, Delaware, and each Party hereby submits to the personal jurisdiction of such courts.

Article 16. Right to Amend

16.1. Compuvi reserves the right to amend this Addendum from time to time in order to reflect changes in applicable laws, regulatory requirements, or service practices. Any material changes shall be communicated to the Customer in advance, and continued use of the services after such notice shall constitute acceptance of the revised terms. Where required by law, Compuvi will seek the Customer's consent prior to implementing any changes that materially affect the rights or obligations of the Parties under this Addendum.

Article 17. Entire Agreement

17.1. This Addendum constitutes the entire agreement between the Parties with respect to the Processing of Personal Data and supersedes any prior discussions, representations, or agreements on the same subject.

Annexure I — Details of Processing

This Annex outlines the mandatory details of the data processing activities carried out by Compuvi Inc. on behalf of the Customer in connection with the services provided through the Confinaid platform, as required under Article 28(3) of the General Data Protection Regulation (GDPR).

1. Subject Matter of the Processing

The subject matter of the processing is the provision of regulatory technology solutions, including but not limited to customer onboarding, risk analysis, KYC automation, document verification, and compliance tracking, as made available through the Confinaid platform.

2. Duration of the Processing

Personal Data will be processed for the duration of the agreement between the Parties, or until the Customer instructs Compuvi to delete or return the data, whichever comes first, unless otherwise required by applicable law.

3. Nature and Purpose of the Processing

The nature of the processing includes collection, storage, structuring, access, use, transmission, analysis, and deletion of Personal Data, all as necessary for the delivery and support of the services offered through the Confinaid platform.

The purpose of the processing is to enable the Customer to use Compuvi's tools to manage regulatory compliance, customer due diligence, and risk scoring processes in an automated and secure environment.

4. Categories of Data Subjects

The Personal Data processed by Compuvi on behalf of the Customer may relate to the following categories of data subjects:

a. Customers and end users of the Customer's business

b. Authorized users of the Confinaid platform

c. Employees, contractors, or representatives of the Customer

d. Other individuals whose data is submitted by or on behalf of the Customer for processing

5. Categories of Personal Data

The categories of Personal Data processed may include:

a. Contact details (e.g., names, email addresses, phone numbers)

b. Identification documents and government-issued numbers

c. Financial data and source of funds information

d. Geolocation data and IP addresses

e. Risk profiles and scoring outputs

f. KYC documentation and biometric identifiers (where applicable)

g. Other data collected through forms, uploads, or integrations configured by the Customer

6. Special Categories of Personal Data (if any)

The Confinaid platform is not intended to process special categories of Personal Data unless expressly configured to do so by the Customer. If such data is processed, it shall be limited to the extent strictly necessary and subject to appropriate safeguards in accordance with applicable law.

Annexure II — Security Measures

This Annex outlines the technical and organizational measures implemented by Compuvi Inc. ("Compuvi") to ensure the security of Personal Data processed on behalf of the Customer in connection with the Confinaid platform. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, in accordance with Article 32 of the General Data Protection Regulation (GDPR).

1. Access Control

Compuvi restricts access to Personal Data to authorized personnel only. Access rights are reviewed regularly and granted based on the principle of least privilege. Administrative and system access is controlled through secure login credentials, multifactor authentication, and role-based permissions.

2. Data Encryption

All Personal Data is encrypted during transmission using Transport Layer Security (TLS). Data at rest is encrypted using industry-standard encryption protocols to prevent unauthorized access in the event of a breach or physical compromise.

3. Network and Infrastructure Security

Compuvi's hosting infrastructure is secured using firewalls, intrusion detection systems, regular vulnerability scanning, and continuous monitoring. Network traffic is segmented to reduce the attack surface, and all systems are hosted in secure, access-controlled environments managed by reputable third-party cloud providers.

4. Application Security

The Confinaid platform is developed following secure coding practices, and code is regularly audited for vulnerabilities. Web application firewalls and rate-limiting mechanisms are implemented to mitigate common attack vectors. Penetration testing is conducted periodically by independent security professionals.

5. Data Backup and Recovery

Compuvi maintains regular encrypted backups of critical systems and data to support business continuity. Backup processes are tested at scheduled intervals to ensure recoverability and resilience in the event of data loss or disaster.

6. Personnel Security and Awareness

All personnel with access to Personal Data receive training on data protection responsibilities and security best practices. Employment agreements include confidentiality obligations, and access to systems is removed immediately upon termination of employment or engagement.

7. Incident Detection and Response

Compuvi maintains an internal incident response protocol that includes procedures for identifying, investigating, mitigating, and documenting security incidents. In the event of a confirmed Personal Data breach, the Customer will be notified in accordance with the terms of this Addendum and applicable laws.

8. Physical Security

Access to facilities and data centers hosting Compuvi systems is restricted to authorized personnel. Physical environments are monitored using surveillance systems, security personnel, and access badge controls, all managed by third-party infrastructure providers in accordance with international standards.

9. Vendor and Subprocessor Oversight

Compuvi evaluates all subprocessors and third-party vendors for their data security practices before engagement. Written data protection agreements are executed, and vendors are monitored for ongoing compliance with relevant security and privacy standards.

10. Audit and Review

Security policies and procedures are reviewed periodically to reflect changes in technology, regulatory requirements, and industry standards. Compuvi may also conduct internal audits to ensure compliance with these controls.