DATA PROCESSING ADDENDUM

Version 1 · Kita Technologies, Inc. · https://kita.ai/legal/dpa/v1

KITA TECHNOLOGIES, INC.

This Data Processing Addendum (this "DPA") supplements the Agreement (as identified in the Key Terms below, the "Agreement"), by and between Kita Technologies, Inc., a Delaware corporation ("Provider"), and the customer identified in the Order Form that references this DPA ("Customer") (each a "Party" and, collectively, the "Parties"). This DPA is subject to all the terms and conditions of the Agreement. By signing the Order Form that references this DPA, each Party agrees to be bound by the terms hereof. Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.

Key Terms

This DPA is incorporated into, and takes effect with, the Order Form that references it. No separate signature is required. Acceptance of that Order Form by both Parties, including by electronic signature, constitutes execution of this DPA by both Parties.

STANDARD TERMS

1. Definitions

The following terms, when used in this DPA, will have the following meanings:

"Cloud Service" means the Kita products and services provided under the Agreement.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing of Personal Data.

"Cover Page" means the Key Terms table of this DPA.

"Customer Instructions" is defined in Section 3.1 below.

"Customer Personal Data" means Personal Data in Customer Data (as defined in the Agreement).

"Data Protection Laws" means all laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including, as applicable: (i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and any binding regulations promulgated thereunder ("CCPA"), (ii) the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR" or "GDPR"), (iii) the Swiss Federal Act on Data Protection ("FADP"), (iv) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR") and (v) the UK Data Protection Act 2018; in each case, as updated, amended or replaced from time to time.

"Data Subject" means the identified or identifiable natural person to whom Customer Personal Data relates.

"EEA" means European Economic Area.

"Personal Data" means information about an identified or identifiable natural person or which otherwise constitutes "personal data," "personal information," "personally identifiable information" or similar terms as defined in Data Protection Laws.

"Processing" and inflections thereof refer to any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.

"Restricted Transfer" means: (i) where EU GDPR applies, a transfer of Customer Personal Data from the EEA to a country outside the EEA that is not subject to an adequacy determination, (ii) where UK GDPR applies, a transfer of Customer Personal Data from the United Kingdom to any other country that is not subject to an adequacy determination or (iii) where FADP applies, a transfer of Customer Personal Data from Switzerland to any other country that is not subject to an adequacy determination.

"Security Incident" means any breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data being Processed by Provider.

"Subprocessor" means any third party authorized by Provider to Process any Customer Personal Data.

"Subscription Term" means the term of the applicable Order Form.

2. Scope and Duration

2.1 Roles of the Parties.

This DPA applies to Provider as a Processor of Customer Personal Data and to Customer as a Controller of Customer Personal Data. Customer, as Controller, determines the purposes and means of Processing; Provider Processes Customer Personal Data only on Customer's documented instructions.

2.2 Scope of DPA.

This DPA applies to Provider's Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws. This DPA is governed by the governing law of the Agreement unless otherwise required by Data Protection Laws or as specified on the Cover Page.

2.3 Duration of DPA.

This DPA commences on the DPA Effective Date and terminates upon expiration or termination of the Agreement (or, if later, the date on which Provider has ceased all Processing of Customer Personal Data).

2.4 Order of Precedence.

In the event of any conflict or inconsistency among the following documents, the order of precedence will be: (1) any Standard Contractual Clauses or other measures to which the Parties have agreed in Schedule 3 (Cross-Border Transfer Mechanisms) or Schedule 4 (Region-Specific Terms), (2) this DPA and (3) the Agreement. To the fullest extent permitted by Data Protection Laws, any claims brought in connection with this DPA (including its Schedules) will be subject to the terms and conditions, including, but not limited to, the exclusions and limitations, set forth in the Agreement.

3. Processing of Personal Data

3.1 Customer Instructions.

(a) Provider will Process Customer Personal Data as a Processor only: (i) in accordance with Customer Instructions or (ii) to comply with Provider's obligations under applicable laws, subject to any notice requirements under Data Protection Laws.

(b) "Customer Instructions" means: (i) Processing to provide the Cloud Service and perform Provider's obligations in the Agreement (including this DPA) and (ii) other reasonable documented instructions of Customer consistent with the terms of the Agreement.

(c) Details regarding the Processing of Customer Personal Data by Provider are set forth in Schedule 1 (Subject Matter and Details of Processing).

(d) Provider will notify Customer if it receives an instruction that Provider reasonably determines infringes Data Protection Laws (but Provider has no obligation to actively monitor Customer's compliance with Data Protection Laws).

3.2 Confidentiality.

(a) Provider will protect Customer Personal Data in accordance with its confidentiality obligations as set forth in the Agreement.

(b) Provider will ensure personnel who Process Customer Personal Data either enter into written confidentiality agreements or are subject to statutory obligations of confidentiality.

3.3 Compliance with Laws.

(a) Provider and Customer will each comply with Data Protection Laws in their respective Processing of Customer Personal Data.

(b) Customer will comply with Data Protection Laws in its issuing of Customer Instructions to Provider. Customer will ensure that it has established all necessary lawful bases under Data Protection Laws to enable Provider to lawfully Process Customer Personal Data for the purposes contemplated by the Agreement (including this DPA), including, as applicable, by obtaining all necessary consents from, and giving all necessary notices to, Data Subjects.

3.4 AI and Machine Learning Processing.

Provider's Processing of Customer Personal Data for any artificial-intelligence or machine-learning purposes (including training, development, or improvement of models or features) is governed solely by the applicable provisions of the Agreement (including the AI Features and Usage Data sections thereof). Any limitations, conditions, or permissions stated in those provisions of the Agreement — including any requirement that data be de-identified, aggregated, or provided on an "as is" basis — apply equally to Provider's Processing under this DPA.

Provider's use of machine learning to provide the Services (i.e., running inference on Customer Personal Data to deliver service functionality) is Processing under this DPA and subject to all of its terms.

3.5 Changes to Laws.

The Parties will work together in good faith to negotiate an amendment to this DPA as either Party reasonably considers necessary to address the requirements of Data Protection Laws from time to time.

4. Subprocessors

4.1 Use of Subprocessors.

(a) Customer generally authorizes Provider to engage Subprocessors to Process Customer Personal Data. Customer further agrees that Provider may engage its Affiliates as Subprocessors. Provider will: (i) enter into a written agreement with each Subprocessor imposing data Processing and protection obligations substantially the same as those set out in this DPA and (ii) remain liable for compliance with the obligations of this DPA and for any acts or omissions of a Subprocessor that cause Provider to breach any of its obligations under this DPA.

4.2 Subprocessor List.

Provider will maintain an up-to-date list of its Subprocessors, including their functions and locations, as specified in the Subprocessor List identified on the Cover Page.

4.3 Notice of New Subprocessors.

Provider may update the Subprocessor List from time to time. At least 30 days (or such other period as specified on the Cover Page) before any new Subprocessor Processes any Customer Personal Data, Provider will add such Subprocessor to the Subprocessor List and notify Customer through email or other means specified on the Cover Page.

4.4 Objection to New Subprocessors.

(a) If, within 30 days after notice of a new Subprocessor, Customer notifies Provider in writing that Customer objects to Provider's appointment of such new Subprocessor based on reasonable data protection concerns, the Parties will discuss such concerns in good faith.

(b) If the Parties are unable to reach a mutually agreeable resolution to Customer's objection to a new Subprocessor, Customer, as its sole and exclusive remedy, may terminate the Order Form for the affected Cloud Service for convenience and Provider will refund any prepaid, unused fees for the terminated portion of the Subscription Term.

5. Security

5.1 Security Measures.

Provider will implement and maintain reasonable and appropriate technical and organizational measures, procedures and practices, as appropriate to the nature of the Customer Personal Data, that are designed to protect the security, confidentiality, integrity and availability of Customer Personal Data and protect against Security Incidents, in accordance with Provider's security program described in the Agreement and as further described in Schedule 2 (Technical and Organizational Measures). Provider will regularly monitor its compliance with its security measures. Provider will not materially diminish the overall security of the Cloud Service during the term of the Agreement.

5.2 Security Incident Notification and Response.

(a) Provider will implement and follow procedures to detect and respond to Security Incidents.

(b) Provider will: (i) notify Customer without undue delay and, in any event, not later than the Breach Notification Period specified on the Cover Page, after becoming aware of a Security Incident affecting Customer and (ii) make reasonable efforts to identify the cause of the Security Incident, mitigate the effects and remediate the cause to the extent within Provider's reasonable control.

(c) Upon Customer's request and taking into account the nature of the applicable Processing, Provider will assist Customer by providing, when available, information reasonably necessary for Customer to meet its Security Incident notification obligations under Data Protection Laws.

(d) Customer acknowledges that Provider's notification of a Security Incident is not an acknowledgement by Provider of its fault or liability.

(e) Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

5.3 Customer Responsibilities.

(a) Customer is responsible for reviewing the information made available by Provider relating to data security and making an independent determination as to whether the Cloud Service meets Customer's requirements and legal obligations under Data Protection Laws.

(b) Customer is solely responsible for complying with Security Incident notification laws applicable to Customer and fulfilling any obligations to give notices to government authorities, affected individuals or others relating to any Security Incidents.

6. Data Protection Impact Assessment

Upon Customer's request and taking into account the nature of the applicable Processing, to the extent such information is available to Provider, Provider will assist Customer in fulfilling Customer's obligations under Data Protection Laws to carry out a data protection impact or similar risk assessment related to Customer's use of the Cloud Service, including, if required by Data Protection Laws, by assisting Customer in consultations with relevant government authorities.

7. Data Subject Requests

7.1 Assisting Customer.

Upon Customer's request and taking into account the nature of the applicable Processing, Provider will assist Customer by appropriate technical and organizational measures, insofar as possible, in complying with Customer's obligations under Data Protection Laws to respond to requests from individuals to exercise their rights under Data Protection Laws, provided that Customer cannot reasonably fulfill such requests independently (including through use of the Cloud Service).

7.2 Data Subject Requests.

If Provider receives a request from a Data Subject in relation to the Data Subject's Customer Personal Data, Provider will notify Customer and advise the Data Subject to submit the request to Customer (but not otherwise communicate with the Data Subject regarding the request except as may be required by Data Protection Laws), and Customer will be responsible for responding to any such request.

8. Data Return or Deletion

8.1 During Subscription Term.

During the Subscription Term, Customer may, through the features of the Cloud Service, access, return to itself or delete Customer Personal Data in accordance with the functionality described in the Agreement and applicable Documentation.

8.2 Post Termination.

(a) Following termination or expiration of the Agreement, Provider will, in accordance with its obligations under the Agreement, delete all Customer Personal Data from Provider's systems.

(b) Deletion will be in accordance with industry-standard secure deletion practices. Provider will issue a certificate of deletion upon Customer's request.

(c) Notwithstanding the foregoing, Provider may retain Customer Personal Data: (i) as required by Data Protection Laws or (ii) in accordance with its standard backup or record retention policies, provided that, in either case, Provider will (x) maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to, retained Customer Personal Data and (y) not further Process retained Customer Personal Data except for such purpose(s) and duration specified in such applicable Data Protection Laws.

9. Audits

9.1 Provider Records.

Provider will keep records of its Processing in compliance with Data Protection Laws and, upon Customer's request, make available to Customer any records reasonably necessary to demonstrate compliance with Provider's obligations under this DPA and Data Protection Laws.

9.2 Third-Party Compliance Program.

(a) Provider will describe its third-party audit and certification programs (if any) and make summary copies of its audit reports (each, an "Audit Report") available to Customer upon Customer's written request at reasonable intervals (subject to confidentiality obligations).

(b) Customer may share a copy of Audit Reports with relevant government authorities as required upon their request.

(c) Customer agrees that any audit rights granted by Data Protection Laws will be satisfied by Audit Reports and the procedures of Section 9.3 (Customer Audit) below.

9.3 Customer Audit.

(a) Subject to the terms of this Section 9.3, Customer has the right, at Customer's expense, to conduct an audit of reasonable scope and duration pursuant to a mutually agreed-upon audit plan with Provider (an "Audit").

(b) Customer may exercise its Audit right: (i) to the extent Provider's provision of an Audit Report does not provide sufficient information for Customer to verify Provider's compliance with this DPA or the Parties' compliance with Data Protection Laws, (ii) as necessary for Customer to respond to a government authority audit or (iii) in connection with a Security Incident.

(c) Each Audit must: (i) be conducted by an independent third party that will enter into a confidentiality agreement with Provider, (ii) be limited in scope to matters reasonably required for Customer to assess Provider's compliance with this DPA and the Parties' compliance with Data Protection Laws, (iii) occur at a mutually agreed date and time and only during Provider's regular business hours, (iv) occur no more than once annually (unless required under Data Protection Laws or in connection with a Security Incident), (v) cover only facilities controlled by Provider, (vi) restrict findings to Customer Personal Data only and (vii) treat any results as confidential information to the fullest extent permitted by Data Protection Laws.

10. Cross-Border Transfers; Region-Specific Terms

10.1 Cross-Border Data Transfers.

(a) Provider (and its Affiliates) may Process and transfer Customer Personal Data globally as necessary to provide the Cloud Service.

(b) If Provider engages in a Restricted Transfer, it will comply with Schedule 3 (Cross-Border Transfer Mechanisms).

10.2 Region-Specific Terms.

To the extent that Provider Processes Customer Personal Data protected by Data Protection Laws in one of the regions listed in Schedule 4 (Region-Specific Terms), then the terms specified therein with respect to the applicable jurisdiction(s) will apply in addition to the terms of this DPA.

11. General

11.1 Conflicts Between Documents.

This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the Standard Contractual Clauses or UK Addendum incorporated in Schedule 3, (2) this DPA, and then (3) the Agreement.

11.2 Amendment.

No amendment or modification to this DPA will be effective unless in writing and signed by both Parties.

11.3 Severability.

If any provision of this DPA is found to be invalid or unenforceable, such provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

Schedule 1

Subject Matter and Details of Processing

Schedule 2

Technical and Organizational Measures

Provider maintains a comprehensive information security program as described in the data security provisions of the Agreement. Provider implements the following technical and organizational measures to protect Customer Personal Data:

Schedule 3

Cross-Border Transfer Mechanisms

1. EEA Transfers.

Customer and Provider agree that if the GDPR protects the transfer of Customer Personal Data, the transfer is from Customer within the EEA to Provider outside of the EEA, and the transfer is not governed by an adequacy decision made by the European Commission, then by entering into this DPA, Customer and Provider are deemed to have entered into the Standard Contractual Clauses (the "EEA SCCs") set forth in the Annex to Commission Implementing Decision (EU) 2021/914, which are incorporated by reference. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:

(a) Module Two (Controller to Processor) of the EEA SCCs applies when Customer is a Controller and Provider is Processing Customer Personal Data for Customer as a Processor.

(b) Module Three (Processor to Sub-Processor) of the EEA SCCs applies when Customer is a Processor and Provider is Processing Customer Personal Data on behalf of Customer as a Subprocessor.

(c) For each Module, the following applies (when applicable):

(i) The optional docking clause in Clause 7 does not apply;

(ii) In Clause 9, Option 2 (general written authorization) applies, and the minimum time period for prior notice of Subprocessor changes is as specified on the Cover Page;

(iii) In Clause 11, the optional language does not apply;

(iv) All square brackets in Clause 13 are removed;

(v) In Clause 17 (Option 1), the EEA SCCs will be governed by the laws of Ireland;

(vi) In Clause 18(b), disputes will be resolved in the courts of Ireland; and

(vii) The Cover Page and Schedule 1 to this DPA contain the information required in Annex I, Schedule 2 contains the information required in Annex II, and the Subprocessor List contains the information required in Annex III of the EEA SCCs.

2. UK Transfers.

Customer and Provider agree that if the UK GDPR protects the transfer of Customer Personal Data, the transfer is from Customer within the United Kingdom to Provider outside of the United Kingdom, and the transfer is not governed by an adequacy decision made by the UK Secretary of State, then by entering into this DPA, Customer and Provider are deemed to have entered into the UK Addendum to the EEA SCCs (the "UK Addendum") issued by the UK Information Commissioner under S119A(1) of the Data Protection Act 2018, which is incorporated by reference. The UK Addendum is completed as follows:

(a) Table 1 of the UK Addendum is completed with the information in the Cover Page of this DPA.

(b) Table 2 of the UK Addendum is completed with the information in Section 1 of this Schedule 3.

(c) Table 3 of the UK Addendum is completed with the information in Schedules 1 and 2 of this DPA and the Subprocessor List.

(d) Table 4 of the UK Addendum is modified as follows: Neither Party may end the UK Addendum as set out in Section 19 of the UK Addendum; to the extent the ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the Parties will work in good faith to revise this DPA accordingly.

3. Swiss Transfers.

For Personal Data transfers where Swiss law (and not the law of any EEA member state or the United Kingdom) applies to the international nature of the transfer, references to the GDPR in the EEA SCCs are, to the extent legally required, amended to refer to the Swiss Federal Act on Data Protection or its successor instead, and the concept of supervisory authority will include the Swiss Federal Data Protection and Information Commissioner.

4. Alternative Transfer Mechanisms.

To the extent that any other transfer mechanism under Data Protection Laws is applicable and provides an adequate level of protection for Customer Personal Data (including, without limitation, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework), Provider may rely on such mechanism in lieu of or in addition to the Standard Contractual Clauses described above.

Schedule 4

Region-Specific Terms

Part A — California Consumer Privacy Act (CCPA/CPRA)

The following terms apply to the extent that the CCPA applies to Provider's Processing of Customer Personal Data:

A.1 Roles.

For purposes of the CCPA: (a) Customer is a "Business" and (b) Provider is a "Service Provider." Provider receives Customer Personal Data from Customer for the limited and specified business purpose of providing the Cloud Service as described in the Agreement.

A.2 Restrictions on Use.

Provider will not: (a) sell or share (as such terms are defined under the CCPA) any Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than for the business purpose of providing the Cloud Service as specified in the Agreement, including retaining, using, or disclosing Customer Personal Data for a commercial purpose other than providing the Cloud Service; or (c) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Provider and Customer.

A.3 Certification.

Provider certifies that it understands the restrictions in this Part A of Schedule 4 and will comply with them. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

A.4 Subcontractor Flow-Down.

Provider will ensure that any Subprocessor engaged to assist with Processing Customer Personal Data subject to the CCPA is bound by written obligations that are no less restrictive than those imposed on Provider under this Part A, including restrictions on selling or sharing Personal Data and the use limitations described in Section A.2.

A.5 Consumer Rights Cooperation.

Provider will assist Customer in responding to verifiable consumer requests made pursuant to the CCPA, including requests to know, delete, correct, and opt out. Provider will comply with Customer's instructions to delete or return Customer Personal Data in connection with such requests.

A.6 Automated Decision-Making Technology.

To the extent that Provider's Cloud Service involves automated decision-making technology ("ADMT") as defined under applicable CCPA regulations, Provider will:

(a) reasonably assist Customer in complying with any applicable pre-use notice requirements, including by providing information about Provider's use of ADMT as it relates to Customer Personal Data;

(b) reasonably assist Customer in honoring consumer requests to opt out of ADMT and to access information about ADMT, to the extent technically feasible through the Cloud Service;

(c) cooperate with Customer in conducting any risk assessments required under applicable CCPA regulations relating to Processing that involves ADMT; and

(d) provide information reasonably requested by Customer for Customer's risk assessment submissions and attestations required under applicable CCPA regulations.

Part B — United Kingdom

The following terms apply to the extent that the UK GDPR applies to Provider's Processing of Customer Personal Data:

B.1 UK Addendum.

Where the UK GDPR applies and Customer Personal Data is transferred outside the United Kingdom in circumstances requiring appropriate safeguards, the UK Addendum incorporated in Schedule 3, Section 2 will apply.

B.2 Supervisory Authority.

For purposes of any supervisory authority references in this DPA, the competent supervisory authority for UK Processing is the UK Information Commissioner's Office (ICO).

Part C — Switzerland

The following terms apply to the extent that the Swiss FADP applies to Provider's Processing of Customer Personal Data:

C.1 Swiss Transfers.

Where the Swiss FADP applies and Customer Personal Data is transferred outside Switzerland in circumstances requiring appropriate safeguards, the provisions of Schedule 3, Section 3 will apply.

C.2 Supervisory Authority.

For purposes of any supervisory authority references in this DPA, the competent supervisory authority for Swiss Processing is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Part D — Philippines (Data Privacy Act of 2012)

D.1 Scope. This Part D applies where the Processing of Customer Personal Data is subject to Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines (the "PH DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (the "NPC"), including NPC Circulars (collectively, "Philippine Data Privacy Laws"). For purposes of this Part D, references in this DPA to "Controller" shall be read as Personal Information Controller ("PIC") as defined in the PH DPA, and references to "Processor" shall be read as Personal Information Processor ("PIP"). Personal Information, Sensitive Personal Information, Personal Data, Data Subject, and Processing shall have the meanings set forth in the PH DPA.

D.2 Roles. As between the Parties, Customer is the PIC with respect to the Customer Personal Data, and Provider is engaged as a PIP solely to Process Customer Personal Data on behalf of Customer and in accordance with Customer's documented instructions. Provider shall not determine the purposes or means of Processing.

D.3 Data Protection Officer. Provider shall designate a Data Protection Officer ("DPO") or Compliance Officer for Privacy and shall, at Customer's request, provide the DPO's contact details. Provider shall register with the NPC, and shall procure the registration of its relevant data processing systems, where and to the extent required by Philippine Data Privacy Laws.

D.4 Security Measures. Provider shall implement and maintain reasonable and appropriate organizational, physical, and technical security measures ("TOPS Measures") consistent with the obligations set out in Sections 25–29, Rule VI of the Implementing Rules and Regulations of the PH DPA, supplemented by the security commitments described in Schedule 2 to this DPA. The TOPS Measures shall include, at a minimum, controls addressed in Schedule 2.

D.5 Breach Notification. Without prejudice to Section 9 (Security Incident Notification and Response) of this DPA, Provider shall notify Customer of any Personal Data Breach (as defined under NPC Circular No. 16-03) within twenty-four (24) hours of becoming aware of it. The notification shall contain the information required under NPC Circular No. 16-03, including the nature of the breach, categories and approximate number of affected Data Subjects and records, likely consequences, and measures taken or proposed to mitigate the breach. Provider shall reasonably cooperate with Customer and, where applicable, with the NPC in connection with any breach notification or investigation.

D.6 Assistance with Data Subject Rights. Provider shall assist Customer in fulfilling Customer's obligation to respond to requests by Data Subjects under Philippine Data Privacy Laws, including the rights to be informed, to access, to object, to correct or rectify, to erase or block, to data portability, and to lodge complaints with the NPC.

D.7 Subprocessors. Provider's engagement of Subprocessors shall comply with Section 4 of this DPA and with the cross-border data sharing and outsourcing provisions of the PH DPA and NPC issuances. Provider shall impose on each Subprocessor written data protection obligations no less protective than those in this DPA, and shall remain primarily liable to Customer for Subprocessors' acts and omissions to the extent required under the PH DPA.

D.8 Cross-Border Transfers. Customer acknowledges that Customer Personal Data may be Processed outside the Philippines (including by Provider and its Subprocessors) as described in Schedule 1. Provider shall comply with the cross-border transfer requirements of the PH DPA and applicable NPC issuances, including implementing contractual or organizational safeguards to ensure continuing protection of the Customer Personal Data.

D.9 Return or Deletion. Section 8 (Data Return or Deletion) of this DPA applies in full. Upon expiration or termination of the Agreement, or upon Customer's earlier written request, Provider shall return or securely dispose of Customer Personal Data in a manner that prevents further Processing, and shall certify such return or disposal in writing at Customer's request, in accordance with Philippine Data Privacy Laws.

D.10 Regulator Cooperation. Provider shall cooperate with Customer and, to the extent required under Philippine Data Privacy Laws, with the NPC and other competent regulatory authorities in connection with any inquiry, investigation, or enforcement action relating to Customer Personal Data.

Part E — Mexico (Federal Law on the Protection of Personal Data Held by Private Parties, 2025)

E.1 Scope. This Part E applies where the Processing of Customer Personal Data is subject to the Federal Law on the Protection of Personal Data Held by Private Parties published in the Diario Oficial de la Federación on March 20, 2025 (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, the "LFPDPPP"), its regulations, and the guidelines and parameters issued by the Secretaría Anticorrupción y Buen Gobierno or any successor authority (the "Mexican Authority") (collectively, "Mexican Data Privacy Laws"). For purposes of this Part E, references in this DPA to "Controller" shall be read as responsable (data controller) and references to "Processor" shall be read as encargado (data processor), in each case as defined under the LFPDPPP.

E.2 Roles. As between the Parties, Customer is the responsable with respect to Customer Personal Data, and Provider is engaged as an encargado to Process Customer Personal Data solely on behalf of Customer and in accordance with Customer's documented instructions. Provider shall not Process Customer Personal Data for purposes other than those instructed by Customer and shall not transfer Customer Personal Data to any third party without Customer's prior written authorization, except as permitted under the applicable provisions of the LFPDPPP and its regulations.

E.3 Privacy Notice and Consent. Customer, as responsable, is responsible for issuing the applicable privacy notice (aviso de privacidad) to Data Subjects in accordance with the applicable provisions of the LFPDPPP and its regulations and for obtaining any consents required for the Processing performed by Provider. Provider shall assist Customer with reasonable information about the Processing to enable Customer to comply with these obligations.

E.4 Security Measures. Provider shall implement and maintain administrative, physical, and technical security measures consistent with the applicable provisions of the LFPDPPP and its regulations, taking into account the sensitivity of the Customer Personal Data and the risks involved. The security commitments described in Schedule 2 of this DPA apply in addition to, and not in limitation of, this Section E.4.

E.5 Breach Notification. Without prejudice to Section 9 of this DPA, Provider shall notify Customer of any vulneración de seguridad (as contemplated under the applicable provisions of the LFPDPPP and its regulations) involving Customer Personal Data within twenty-four (24) hours of becoming aware of it, and shall provide the information required for Customer to fulfill its notification obligations to affected Data Subjects and to the Mexican Authority, where applicable.

E.6 Assistance with ARCO Rights. Provider shall assist Customer in responding to requests by Data Subjects to exercise their rights of access, rectification, cancellation, and objection ("ARCO rights") and to revoke consent under the LFPDPPP. Provider shall not respond to ARCO requests directly unless expressly instructed by Customer or required by law.

E.7 Subprocessors and Sub-Transfers. Provider's engagement of Subprocessors shall comply with Section 4 of this DPA and with the applicable provisions of the LFPDPPP and its regulations. Each Subprocessor shall be bound by written obligations no less protective than those set out in this DPA, and Provider shall remain responsible for the acts and omissions of its Subprocessors to the extent required under Mexican Data Privacy Laws.

E.8 Cross-Border Transfers. Customer acknowledges that Customer Personal Data may be Processed outside Mexico (including by Provider and its Subprocessors) as described in Schedule 1. Provider shall implement contractual or organizational safeguards to ensure the continuing protection of Customer Personal Data following any such transfer, consistent with the applicable provisions of the LFPDPPP and its regulations.

E.9 Return or Deletion. Section 8 (Data Return or Deletion) of this DPA applies in full. Upon expiration or termination of the Agreement, or upon Customer's earlier written request, Provider shall return or securely dispose of Customer Personal Data in a manner that prevents further Processing, consistent with the applicable provisions of the LFPDPPP and its regulations.

E.10 Regulator Cooperation. Provider shall cooperate with Customer and, to the extent required under Mexican Data Privacy Laws, with the Mexican Authority and other competent regulatory authorities in connection with any inquiry, investigation, or verification procedure relating to Customer Personal Data.