DATA PROCESSING ADDENDUM

1. Definitions and application

Data Protection Law means privacy and data protection laws applicable to the relevant processing, which may include the EU GDPR, UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection, applicable U.S. state privacy laws including the California Consumer Privacy Act as amended ("CCPA"), applicable Canadian federal and provincial privacy laws, the Australian Privacy Act, and Brazil's LGPD. Naming a law does not make it apply where its legal conditions are absent.

Customer Personal Data means Personal Data processed by Guardix on behalf of Customer under the Agreement. Personal Data includes personal information and equivalent terms under applicable law. Subprocessor means another processor engaged by Guardix to process Customer Personal Data. Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. An unsuccessful attempt that does not compromise Customer Personal Data is not itself a Security Incident.

Restricted Transfer means a disclosure, transfer, or access requiring an international transfer safeguard under applicable Data Protection Law. SCCs means the applicable standard contractual clauses identified in Section 12 and Schedule 4.

2. Roles and scope

Customer acts as controller, or as a processor authorized by its controller, and Guardix acts as processor or subprocessor. Under applicable U.S. state laws, Guardix acts as a service provider or contractor to the extent those classifications apply. The actual processing and applicable law determine the parties' roles.

The processing details are in Schedule 1. This DPA does not govern information Guardix lawfully processes as an independent controller for its own account administration, billing relationship, and similar disclosed business purposes. Such processing remains subject to the Privacy Policy and applicable law. Guardix will not reclassify Customer operational content as independent controller data to avoid this DPA.

3. Documented instructions and permitted purposes

Guardix will process Customer Personal Data only on documented instructions from Customer, including the Agreement, this DPA, authorized configurations and feature requests, and other mutually accepted written instructions. The instructions authorize processing necessary to provide, secure, maintain, and support the purchased Services, including enabled AI functions, and to return or delete data as agreed.

If law requires processing outside those instructions, Guardix will inform Customer before processing unless that law prohibits notice on important grounds of public interest. Guardix will promptly inform Customer if, in its opinion, an instruction infringes applicable Data Protection Law, and may pause the affected processing while the parties resolve the issue. Guardix is not required to follow an unlawful instruction.

Guardix will not sell Customer Personal Data or use it for unrelated advertising. Guardix will not use or permit its use to train a shared foundation model without Customer's prior, specific written authorization and a lawful basis for the proposed processing. An instruction to generate an AI response is not authorization for unrelated model training. Guardix will apply corresponding restrictions to AI Subprocessors.

Guardix may create or use aggregate or deidentified information only where lawfully permitted, consistent with Customer instructions and applicable contractual restrictions. Where required by law, Guardix will maintain deidentified information in that form, not attempt reidentification except for a legally permitted purpose, and require appropriate restrictions on recipients. Removing a name alone does not necessarily deidentify information.

4. Customer obligations

Customer is responsible for the lawfulness of its instructions, the accuracy and relevance of data supplied, required notices and legal bases, and configuration of available access and retention controls. Customer will collect only data appropriate to the purpose and will not submit sensitive data unless necessary for an agreed feature and subject to required safeguards.

Customer must obtain controller authorization when it acts as a processor. For workforce monitoring, location, recordings, biometrics, and information about minors or incidents, Customer must address applicable employment consultation, recording permissions, consent or written release, impact assessment, and retention requirements before deployment. Guardix remains independently responsible for obligations that apply to its own processing.

5. Confidentiality and authorized personnel

Guardix will limit access to personnel who need it to perform authorized duties. Those personnel will be subject to an enforceable duty of confidentiality or an appropriate statutory obligation and will receive privacy and security training relevant to their responsibilities. Access will be reviewed and removed when no longer authorized.

6. Security measures

Guardix will implement and maintain technical and organizational measures appropriate to the risk, taking into account the nature, scope, context, and purposes of processing, the sensitivity of data, and the potential impact on individuals. The agreed measures are in Schedule 2.

Guardix may update measures to address technology and risk changes provided the changes do not materially reduce the overall level of protection for the contracted processing. A certification, audit report, service level, recovery target, or regional hosting commitment applies only if expressly documented and accurate; this DPA does not itself represent that a particular certification has been obtained.

7. Subprocessors

Customer gives general written authorization for Guardix to engage Subprocessors, including those identified in the register in Schedule 3, which Guardix may update from time to time. Before a new Subprocessor or a material replacement processes Customer Personal Data, Guardix will update the register and notify Customer's designated contact, describing its function and processing locations. Where a change is urgently needed for security, legal compliance, or continuity of the Services, Guardix may make it immediately and notify Customer as soon as reasonably practicable. Customer will maintain a working contact for those notices.

Customer may object within 10 days of notice on reasonable, documented data protection grounds. The parties will work in good faith to address the objection, including an alternative configuration or provider where reasonably available. If the objection cannot be resolved before processing begins, Guardix will not route the affected Customer Personal Data to the disputed provider without another lawful resolution. Either party may terminate the affected portion of the Services if no reasonable solution is available; Guardix will refund prepaid, unused fees for that terminated portion.

Guardix will impose written obligations on each Subprocessor that provide the protections required by applicable law and are no less protective in substance for the relevant processing. Guardix remains responsible for a Subprocessor's performance of those obligations as required by this DPA and applicable law. International access by a Subprocessor is subject to Section 12.

8. Security Incident response

Guardix will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. Guardix will not postpone initial notice until an investigation is complete. Notice will be sent to Customer's designated security or account contact through an appropriate channel.

To the extent available, notice will describe the nature of the incident, affected data and people, likely consequences, containment or remediation measures, and a contact for further information. Information may be supplied in phases without undue further delay. Guardix will investigate, take reasonable steps to contain and remediate, preserve relevant evidence, and cooperate with Customer's lawful response obligations.

Customer is responsible for notifications it is required to make as controller. Guardix will not notify affected individuals or regulators on Customer's behalf without authorization unless required by law. Nothing prevents Guardix from fulfilling a legal obligation directly applicable to it. Incident communication is not, by itself, an admission of liability.

9. Requests, assessments, and regulatory assistance

Taking into account the nature of processing and the information available to it, Guardix will provide reasonable assistance with:

• Requests to access, correct, delete, restrict, object, obtain portability, or exercise other applicable individual rights.
• Security obligations, breach assessment and notification, data protection impact assessments, and prior regulatory consultation.
• Customer's necessary transfer assessments and lawful inquiries concerning processing under this DPA.

If Guardix receives a request relating to Customer-controlled data, it will promptly direct or forward it to Customer, unless prohibited by law, and will not independently decide the request except on Customer instructions or as legally required. Customer authorizes Guardix to identify Customer to the requester when appropriate to direct the request.

Guardix will inform Customer of a legally binding government request for Customer Personal Data unless prohibited. It will assess the request's legal validity, seek clarification or challenge it where required by an applicable transfer instrument or law, and disclose no more than lawfully required. Required SCC government access obligations remain fully applicable.

The parties may agree reasonable charges for exceptional, substantial assistance outside ordinary service support, except to the extent charges are prohibited by law or the work is required to remedy Guardix's breach. Charges must not prevent legally required cooperation.

10. Accountability and audits

Guardix will make available information reasonably necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, required by applicable law. The parties will first use available current documentation and independent assurance reports where these adequately address the inquiry.

If additional verification is reasonably necessary, Customer or an independent auditor bound by confidentiality may conduct a proportionate audit on reasonable notice during normal business hours. Customer will avoid unnecessary disruption and access to another customer's information. Reasonable coordination and confidentiality conditions must not prevent an audit required by law, a regulator, an applicable transfer instrument, or a credible Security Incident. Guardix will address material findings within a risk-appropriate period and provide information about remediation.

11. Return, deletion, and retention

During the subscription, Guardix will apply the Customer's agreed retention instructions and the retention terms in Section 11. Customer can use available tools to export or delete data within its permissions.

At the end of the relevant processing, Guardix will, at Customer's choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires retention. Customer may export Customer Personal Data for at least 30 days after the subscription ends, or any longer period Guardix allows or the Order specifies. After the export period, Guardix will delete or deidentify Customer Personal Data in active systems within a reasonable time, and backup copies will expire on Guardix's rolling backup cycle. Biometric identifiers are destroyed within a reasonable time, and no later than one year after the purpose for collecting them ends. These periods do not extend a shorter mandatory biometric or other legal retention limit.

Until protected backup copies expire under the agreed backup deletion cycle, Guardix will isolate them from ordinary use and continue to apply this DPA. If a backup is restored for disaster recovery, relevant deletion instructions will be reapplied. Information retained under law will be limited to the required purpose, protected, and deleted when that obligation ends. Guardix will certify completion of deletion on reasonable request, subject to a transparent explanation of permitted residual retention.

12. International processing and transfers

Customer authorizes the processing locations identified in the service documentation and the Subprocessor register in Schedule 3, subject to applicable Data Protection Law. The currently disclosed primary hosting location is the United States; no local residency commitment arises without an express written agreement. Remote access from another country can itself be a Restricted Transfer.

The parties will not make a Restricted Transfer without a valid applicable mechanism and any required assessment or supplementary measures. Where legally applicable, Schedule 4 incorporates the EU SCCs, UK Addendum, and Swiss adaptations. If an incorporated instrument is legally unavailable for a particular transfer, the parties must put another valid mechanism in place before that transfer; a general authorization or Customer's acceptance of this DPA is not a substitute.

For Canada, Australia, Brazil, and other jurisdictions, the parties will meet the applicable accountability, contractual, assessment, disclosure, and transfer requirements. Where Brazilian rules require ANPD clauses or another recognized instrument, the parties must execute or otherwise validly adopt that instrument before relying on it. EU SCCs are not automatically a transfer mechanism under every national law.

Where a required safeguard can no longer be met, the parties will promptly assess alternatives and suspend the affected transfer if necessary. Guardix will comply with applicable transfer-clause duties concerning notification, supplementary measures, termination, and return or deletion.

13. U.S. service provider and contractor terms

To the extent Customer Personal Data is subject to a U.S. state law requiring these restrictions, Guardix will:

1. Process it only for the specific business purposes described in this DPA and the Agreement, or another purpose expressly permitted by that law.
2. Not sell or share it, as those terms are defined by the applicable law.
3. Not retain, use, or disclose it outside those specified purposes or outside the direct business relationship with Customer, except as permitted by law.
4. Not combine it with personal information from another person, source, or Guardix's own interactions except to the extent expressly permitted for a service provider or contractor.
5. Comply with applicable obligations and provide the same level of privacy protection required by the applicable law.
6. Notify Customer if Guardix determines it can no longer meet those obligations, and permit Customer to take reasonable and appropriate steps to stop and remediate unauthorized use.
7. Permit reasonable monitoring and compliance verification consistent with Section 10 and impose legally required restrictions on downstream recipients.
8. Assist Customer with applicable consumer requests and provide notices of additional processing engagements where required.

Guardix certifies that it understands and will comply with applicable service provider and contractor restrictions. These provisions do not remove privacy, biometric, or employment protections applicable outside a state comprehensive privacy law.

14. Liability, priority, and duration

The Agreement's liability provisions apply between the contracting parties except to the extent prohibited by law or inconsistent with a mandatory transfer instrument. No limitation restricts a data subject's rights, a regulator's powers, or liability that the SCCs or another mandatory instrument does not allow the parties to limit.

If there is a conflict, the applicable mandatory transfer instrument prevails, followed by this DPA for processing matters, followed by the remaining Agreement. This DPA continues while Guardix or its Subprocessors retain Customer Personal Data. Changes cannot retroactively reduce mandatory protections or take effect in a manner that violates the Agreement or law.

The parties' affirmative acceptance of the Agreement incorporating this DPA also constitutes acceptance of its applicable transfer instruments in a legally binding form. Customer-specific party details, authorizations, and locations are those set out in the Order and the Schedules to this DPA.

Schedule 1 — Processing details and transfer description

Acceptance of the Agreement is the parties' signature and date for incorporation purposes where legally sufficient. An executed Order or separate signature page must identify the actual parties and date where required.

Schedule 2 — Technical and organizational measures

Proposed contractual security schedule: Guardix must validate these measures against its deployed services before execution. Measures must be implemented for the relevant processing, including by appropriate contracted infrastructure providers; this list is not a statement of an independently certified audit result.

Schedule 3 — Authorized Subprocessor register

This register is incorporated into this DPA and may be updated by Guardix from time to time under the change procedure in Section 7. It lists the Subprocessors that may process Customer Personal Data. Providers for optional features process data only when the Customer enables those features.

Guardix may also use other providers for monitoring, security, customer support, and payments; any such provider that processes Customer Personal Data will be added to this register under Section 7. Transfers outside the EEA, UK, or Switzerland rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider is certified, the Standard Contractual Clauses, or another lawful transfer mechanism described in Section 12 and Schedule 4. Guardix requires AI providers to process Customer Personal Data only to provide the requested feature, and not to train their general models on it.

The current register is also published on our Subprocessors page. Customers can subscribe to change notices at privacy@guardix.com.

Schedule 4 — International transfer provisions

A. EEA transfers

Where the EU SCCs are a legally valid mechanism for the particular Restricted Transfer, the clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated by reference, without altering their mandatory terms. The official text is available at: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914.

The selections are:

• Module Two where Customer is a controller and Guardix is a processor; Module Three where Customer is a processor and Guardix is its subprocessor. Apply only the module relevant to each transfer.
• Clause 7: the optional docking clause applies. An additional party must complete the required accession details and approvals; it is not added merely by accessing the Services.
• Clause 9(a): Option 2, general written authorization. Advance notice period: 30 days, consistent with Section 7.
• Clause 11(a): the optional independent dispute resolution wording is not adopted. Mandatory redress rights remain unchanged.
• Clause 13 and Annex I.C: the authority identified in Schedule 1, determined under the applicable Clause 13 criteria.
• Clause 17: Option 1; the laws of Ireland, provided they allow the required third-party beneficiary rights.
• Clause 18(b): the courts of Ireland, without restricting a data subject's forum rights under Clause 18(c).
• Annex I.A and I.B: Schedule 1 and the applicable Order supply party and transfer details. Annex II: Schedule 2. Annex III: Schedule 3, to the extent required for the applicable authorization arrangement.

The parties will comply with SCC obligations concerning local laws and government access, transfer assessment, supplementary measures, notifications, suspension, and termination. The SCCs are not treated as available where their legal scope excludes the relevant importer processing; another valid safeguard is required in that situation.

B. UK transfers

For Restricted Transfers subject to UK law that rely on standard contractual safeguards, the parties incorporate the ICO's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force 21 March 2022, including its mandatory Part 2 and revisions that become applicable under that Part. Official approved text: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf.

For Part 1:

• Table 1: the parties and key contacts are those in Schedule 1 and the Order. The start date is the date the DPA becomes binding for the relevant transfer.
• Table 2: the 2021 EU SCCs and applicable Module Two or Three selected in Part A, including the same Clause 7, Clause 9, and Clause 11 selections.
• Table 3: the Appendix Information is supplied by Schedules 1, 2, and 3 and the Order, as applicable.
• Table 4: both Importer and Exporter may exercise the termination right in Section 19 of the Approved Addendum when its conditions are satisfied.

The Addendum modifies the incorporated EU SCCs for UK transfers as its mandatory terms require, including applicable UK supervision, law, and courts. Unmodified EU SCCs alone are not relied on as the safeguard for a UK Restricted Transfer.

C. Swiss transfers

For Restricted Transfers subject to the Swiss FADP, the parties use recognized clauses with the adaptations necessary under Swiss law. For transfers relying on the EU SCCs, references to the GDPR include the FADP to the extent relevant to the Swiss transfer; references to an EU Member State do not prevent a person in Switzerland from exercising rights at their habitual residence; and the FDPIC is the competent authority for matters governed by Swiss law.

For transfers subject exclusively to the FADP, references to EU institutions, applicable law, and competent courts are interpreted to give effect to Swiss requirements, with Swiss law for Clause 17 and the competent Swiss courts for Clause 18, while preserving mandatory data subject rights. For transfers also subject to the GDPR, EU selections remain effective for the GDPR component and the Swiss adaptations operate alongside them. Swiss transfers use the Standard Contractual Clauses with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.

D. Other jurisdictions and additional instruments

Where another jurisdiction requires mandatory national clauses, an assessment, regulator action, or a specified contractual provision, the parties will complete that requirement before the relevant Restricted Transfer. For Brazilian transfers, any ANPD standard clauses used must be adopted in the form required by the applicable Brazilian rules. Canadian accountability and applicable provincial requirements, and Australian overseas disclosure requirements, remain applicable where their legal conditions are met.

No statement in this DPA represents that Guardix is certified under the EU-U.S., UK extension, or Swiss-U.S. Data Privacy Framework, or that every destination is adequate. A certification or adequacy mechanism may be relied on only when independently applicable to the actual transfer and recipient.