APPENDIX 2 – DATA PROCESSING AGREEMENT (DPA)

1. Scope, roles and processing

1.1. Appendix 2 applies to the extent Digicust processes personal data for the Customer. The Customer acts as controller or as processor for an upstream controller; Digicust acts accordingly as processor or subprocessor. If the Customer acts as processor, it ensures that the processing, its instructions and the engagement of Digicust are covered by its agreement with the upstream controller and that all required authorisations are in place. Applicable data protection law means the GDPR and any other data protection law mandatorily applicable to the relevant processing.

1.2. The subject matter, duration, nature and purpose, types of data and categories of data subjects are set out in Appendix 2-A. Processing continues until personal data processed on behalf of the Customer has been returned or erased.

1.3. Data protection roles are determined by the relevant processing purpose. Personal Customer Data and Customer-related usage, permission and log data processed by Digicust on documented instructions to provide the Platform or agreed support remain processing on behalf of the Customer. Digicust acts as an independent controller to the extent it processes contract, contact, user-account and billing data, and the technical metadata and security logs necessary for its own contract and account administration, billing, fraud and abuse prevention, information security, compliance with its own legal obligations, or the establishment, exercise or defence of legal claims. Details, legal bases and retention periods are provided in the current Privacy Policy at https://www.digicust.com/en/privacy/. It serves solely to provide information required by data protection law, does not form part of the Agreement or this DPA and does not expand any processing purpose or legal basis; mandatory rights and information obligations remain unaffected. Digicust does not use data processed on behalf of the Customer for its own advertising, general model training or independent product development.

2. Instructions and confidentiality

2.1. Digicust processes personal data only on documented instructions from the Customer, including with regard to transfers to a third country or an international organisation. The Agreement, agreed Platform use and lawful settings made by authorised users constitute documented instructions. Further instructions are given in text form.

2.2. If Union law or Member State law to which Digicust is subject requires processing other than on the Customer's documented instructions, Digicust informs the Customer of that legal requirement before processing unless the law prohibits such information on important grounds of public interest. If Digicust considers an instruction to infringe data protection law, it informs the Customer without undue delay and suspends the affected processing pending clarification to the extent legally permissible.

2.3. Access is limited to authorised persons who are bound by confidentiality and appropriately trained. Digicust limits permissions according to tasks and protection needs.

3. Security

3.1. Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the likelihood and severity of risks, Digicust implements appropriate technical and organisational measures under Article 32 GDPR. The agreed measures are set out in Appendix 2-B.

3.2. Digicust regularly reviews the effectiveness of the measures and may replace them with equivalent or more effective measures, provided the agreed level of protection is not reduced. Digicust informs the Customer of material changes before implementation; urgently required security changes are notified without undue delay afterwards.

4. Subprocessors and third-country transfers

4.1. The Customer grants Digicust general authorisation to engage further processors. The initial set approved and active at conclusion of the Agreement is determined exclusively by Section A of Appendix 2-C. Section B lists planned providers for transparency only; their first engagement remains fully subject to clauses 4.2 and 4.3. Digicust provides Appendix 2-C in a form capable of being stored before acceptance. For each provider, Appendix 2-C states at least the legal entity and address; purpose and scope; data types; hosting and processing regions; third-country or remote access; transfer basis and supplementary safeguards; and engagement status and date last reviewed or updated. Approval covers only the provider, purpose, data, region and transfer configuration disclosed there.

4.2. Digicust informs the Customer by email at the most recently notified contract or data protection contact address at least 30 calendar days before adding or replacing a subprocessor and before any material change to its purpose, scope, processing region or third-country or remote access. No later than conclusion of the Agreement, the Customer provides Digicust with a current contract or data protection contact email address for these notices, keeps it operational, monitors it regularly and notifies Digicust of changes without undue delay in text form. Unless the Customer provides a separate data protection contact address, the contract contact email address stated in the Offer applies. The notice includes the information needed for a data protection assessment. In the event of unforeseeable urgency for security, legal or continuity reasons, Digicust may, to the extent objectively necessary and notwithstanding the period in the first sentence and the objection period under clause 4.3, suspend the affected processing or temporarily switch to an already approved subprocessor. A subprocessor not yet approved receives personal data only after prior notice and an objection period that is reasonable in the circumstances or the Customer's express consent. Digicust informs the Customer of the urgency and the measure taken without undue delay; in all other respects, the objection and termination rights under clause 4.3 remain unaffected.

4.3. The Customer may object within 14 calendar days after receipt for substantiated data protection reasons. Without a timely objection, the change is deemed approved. If the Customer objects in time, Digicust does not use the relevant subprocessor for the Customer's data pending resolution. The parties seek an appropriate data-protection-compliant solution. If no reasonable alternative is available, either party may terminate the objectively affected Platform scope; Digicust refunds prepaid fees pro rata for the period after termination.

4.4. Digicust imposes on each subprocessor, by contract or other binding legal act, the same data protection obligations that apply to Digicust under Appendix 2, in particular regarding appropriate technical and organisational measures. Digicust remains fully responsible to the Customer for the subprocessor's performance of those obligations.

4.5. Processing takes place as a rule within the European Union or European Economic Area. A transfer to a third country or an international organisation takes place only on the Customer's documented instructions and in compliance with Chapter V GDPR. Approval of a subprocessor whose third-country or remote access was disclosed to the Customer in a form capable of being stored under clause 4.1 or 4.2 constitutes such an instruction. Digicust relies on an adequacy decision or appropriate safeguards, in particular applicable Standard Contractual Clauses, conducts required transfer assessments and implements necessary supplementary measures. If the transfer basis ceases to apply, Digicust suspends the affected transfer, informs the Customer and resumes it only after establishing a lawful transfer basis.

5. Assistance and personal data breaches

5.1. Taking into account the nature of processing, Digicust assists the Customer, insofar as possible through appropriate technical and organisational measures, with responding to requests for the exercise of data subject rights and, taking into account the information available, with compliance with Articles 32 to 36 GDPR. Requests received directly by Digicust from data subjects are forwarded without undue delay and are not answered on the merits without instructions.

5.2. Digicust notifies the Customer of a personal data breach affecting personal data processed on behalf of the Customer without undue delay after becoming aware of it. To the extent available, the notice includes the nature and scope, affected data and persons, likely consequences, measures taken or proposed and a contact. Missing information is provided without undue delay as it becomes available.

5.3. Digicust documents relevant incidents, assists with containment and remediation and reasonably supports the Customer with data protection impact assessments, prior consultations and required notifications to supervisory authorities and data subjects.

6. Evidence and audits

6.1. Digicust provides all information required to demonstrate compliance with Article 28 GDPR and Appendix 2. Current certificates, audit reports, security documentation and structured questionnaires are used as the primary means of verification to the extent they adequately serve the audit purpose.

6.2. Digicust allows for and contributes to audits, including inspections, conducted by the Customer or a qualified auditor mandated by the Customer and bound by confidentiality. Such audits generally take place once in each twelve-month period, during normal business hours and on at least 30 calendar days' notice. Additional audits and shorter reasonable notice are permitted following a relevant data protection incident, specific doubts about compliance, an order of a supervisory authority or other urgency.

6.3. Audits must not unreasonably interfere with operations, security, other customers' data, source code or trade secrets. Equivalent evidence is given priority to the extent that it fully serves the audit purpose; this does not restrict the statutory audit right. Mandatory powers of supervisory authorities remain unaffected.

7. Return and erasure

7.1. After completion of the processing services under the Agreement, Digicust, at the Customer's choice, erases or returns all personal data processed on the Customer's behalf and erases existing copies unless mandatory law requires retention. Unless the Customer requests earlier return or erasure, this takes place after the retrieval period under Appendix 1 clause 6.2 or a mandatory period expiring later. Data in active systems are then erased without undue delay. Unless Appendix 1 clause 6.4 or mandatory law requires earlier full erasure, backup copies are erased or overwritten in the documented regular rotation cycle and protected from use in production systems until then. The export, switching, retrieval and erasure rights under Appendix 1 clause 6 remain unaffected.

8. Customer duties

8.1. The Customer is responsible for the lawfulness, transparency, purpose limitation, data minimisation and accuracy of data and instructions. It ensures required legal bases and information. If it acts as processor, it additionally ensures the required authorisation of the upstream controller and aligned instructions. If its agreement with the upstream controller contains additional data protection obligations, the parties agree them with Digicust in an addendum before the affected processing begins; until then, that processing does not begin. It transfers special-category or criminal-offence data only after express agreement of additional safeguards.

8.2. The Customer protects its own accounts, devices, interfaces and credentials and promptly reports suspected unauthorised use. It ensures that its instructions and use of the Platform do not infringe data subject rights.

9. Term, liability and precedence

9.1. Appendix 2 applies as long as Digicust processes personal data on behalf of the Customer or return, evidence or erasure duties remain outstanding. Ordinary cooperation under Appendix 2 is included in the agreed fee. Extraordinary Customer-requested work outside Digicust's statutory and contractual duties may, after prior coordination, be charged at the agreed rate or otherwise at the hourly rate under Appendix 1 clause 3.4; this does not apply to the extent the work was caused by Digicust's breach.

9.2. Liability is governed by Appendix 1. Mandatory claims, in particular under Article 82 GDPR, powers of supervisory authorities and statutory rights of recourse remain unaffected.

9.3. Mandatorily applicable Standard Contractual Clauses and expressly agreed data protection addenda prevail over Appendix 2. Otherwise, the governing law and jurisdiction in the Agreement apply. Appendix 2 alone does not create joint controllership; any actually different allocation of roles must be separately agreed before the affected processing begins.

APPENDIX 2-A – DESCRIPTION OF PROCESSING

This Appendix applies exclusively to the modules and functions agreed in the Offer, enabled for the Customer and actually used by the Customer.

APPENDIX 2-B – TECHNICAL AND ORGANISATIONAL MEASURES

The measures are applied on a risk basis. Digicust may use equivalent or more effective measures without reducing the agreed level of protection.

Organisation and personnel

• documented responsibilities for data protection, information security and incidents;
• confidentiality obligations and regular role-based training;
• documented joiner, role-change and leaver processes;
• regular effectiveness reviews and risk-based improvement of measures.

Identity, access and tenant separation

• personalised accounts, role-based permissions and least-privilege principle;
• multi-factor authentication for privileged and other risk-relevant access;
• regular access reviews and prompt removal of rights no longer needed;
• logical tenant separation and controlled administrative production access;
• logging of security-relevant access and administrative changes;
• data classification and pseudonymisation where technically provided.

Transmission, storage and development

• appropriate encryption in transit and, where required by risk and the state of the art, at rest;
• controlled interfaces and transfer channels for agreed integrations;
• traceability of entries, changes and erasures;
• separated development, test and production processes where technically applicable;
• change, approval and CI/CD controls for production changes;
• data minimisation and restricted use of production personal data for testing.

Availability and recovery

• monitoring and logging, including capacity and availability monitoring;
• documented backup and recovery procedures;
• infrastructure protection through appropriate network, firewall, endpoint, system and malware controls;
• incident response, escalation, emergency and recovery processes;
• procedures for recoverability and resilience;
• physical safeguards of the data-centre providers used.

Vulnerabilities, providers and data lifecycle

• risk-based patch, update and vulnerability processes;
• documented selection and oversight of security-relevant subcontractors;
• traceable retention, export, blocking and erasure processes, including for log data;
• privacy-friendly default settings and controls ensuring processing in accordance with instructions;
• erasure from active systems and backups in accordance with Appendix 2 clause 7.

APPENDIX 2-C – SUBPROCESSOR REGISTER

This Register was last reviewed and updated on 21 July 2026. Section A contains the initial set approved and active at conclusion of the Agreement. It comprises eight providers engaged directly by Digicust and Nebius B.V. as Inceptron’s downstream subprocessor. Section B lists two planned providers for transparency only. Regional storage does not automatically exclude disclosed remote access or other international processing.

A. Approved and active subprocessors

1. Google Cloud

2. Hetzner

3. Microsoft Azure

4. Amazon Web Services

5. Cloudflare

6. Sentry

7. Lyceum Technology

8. Inceptron

9. Nebius as Inceptron’s downstream subprocessor

B. Planned providers

Inclusion in this Section constitutes neither approval nor commencement of processing. Before first engagement, Digicust shall complete the notice and objection procedure under Appendix 2 clauses 4.2 and 4.3.

1. OpenAI

2. Nebul

The version of this Appendix provided before acceptance constitutes the initial set approved at conclusion of the Agreement. Changes are governed exclusively by Appendix 2 clauses 4.2 and 4.3.