Data Processing Agreement.

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. In this DPA:

• "Data Protection Laws" means all laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (the "EU GDPR"), the EU GDPR as incorporated into UK law and the UK Data Protection Act 2018 (the "UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA"), and other U.S. federal and state privacy laws.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing" (and "Process") and "Supervisory Authority" have the meanings given in the EU GDPR and include the equivalent terms under other Data Protection Laws (such as "business", "service provider", "contractor" and "personal information" under the CCPA).
• "Customer Personal Data" means Personal Data contained in Customer Data that Dviz Processes on Customer's behalf in providing the Services.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by Dviz or its Sub-processors.
• "Sub-processor" means any third party engaged by Dviz to Process Customer Personal Data.
• "EU SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018.
• "Restricted Transfer" means a transfer of Customer Personal Data (directly or by onward transfer) from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognized by the competent authority as providing an adequate level of protection.

2. Roles of the parties and scope

For Customer Personal Data, Customer is the Controller (or a Processor acting on behalf of its own controller) and Dviz is the Processor (or Sub-processor). Under the CCPA and similar U.S. laws, Dviz is Customer's service provider or contractor.

This DPA applies only to Customer Personal Data. Dviz is an independent controller for the limited personal data it processes for its own purposes, such as account administration, billing, security and service usage data, as described in the Dviz Privacy Policy. That processing is not carried out on Customer's behalf and is not covered by this DPA.

Where Customer deploys Sorgi in its own cloud environment, Customer Personal Data remains in that environment, and Dviz Processes it only to the extent Dviz accesses it to provide, support or operate the Services in accordance with Customer's instructions.

The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex I.

3. Customer's instructions

Dviz will Process Customer Personal Data only on Customer's documented instructions, including with regard to Restricted Transfers, unless Union, Member State or other applicable law to which Dviz is subject requires otherwise. In that case, Dviz will inform Customer of that legal requirement before Processing, unless the law prohibits this on important grounds of public interest.

Customer's documented instructions are: the Agreement and this DPA; Customer's configuration and use of the Services (including the tools it connects, the agents, workflows and test suites it builds, and the AI model providers it selects); and any further written instructions that Customer gives and Dviz accepts as consistent with the Agreement.

Dviz will immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Dviz will not Process Customer Personal Data for its own purposes, and will not use Customer Personal Data or other Customer Data to train or fine-tune AI models, unless Customer agrees in writing.

Customer is responsible for the lawfulness of its instructions, for having a lawful basis for the Processing, and for providing any notices and obtaining any consents required by Data Protection Laws.

4. Confidentiality

Dviz will ensure that every person it authorizes to Process Customer Personal Data, including employees and contractors, has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and accesses Customer Personal Data only as needed to provide the Services.

5. Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risks to Data Subjects, Dviz will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. The measures in place at the date of this DPA are described in Annex II.

Dviz will regularly test, assess and evaluate these measures and may update them, provided that updates do not materially reduce the overall level of protection.

6. Sub-processors

Customer gives Dviz general written authorization to engage Sub-processors. The Sub-processors in use are listed in the Dviz Trust Center (Annex III) or provided on request.

Dviz will notify Customer at least thirty (30) days before adding or replacing a Sub-processor. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if they cannot resolve it, Customer may terminate the affected Services by written notice and receive a pro rata refund of prepaid fees for the terminated part.

Dviz will impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Dviz remains fully liable to Customer for the performance of each Sub-processor's obligations.

AI model providers that Dviz provisions for the Services are Sub-processors. Where Customer connects its own account with an AI model provider or other third-party tool, that provider is not a Dviz Sub-processor; it acts under Customer's own agreement with it, and Customer is responsible for that relationship.

7. Data Subject requests

Taking into account the nature of the Processing, Dviz will assist Customer by appropriate technical and organizational measures, insofar as possible, to fulfil Customer's obligation to respond to requests from Data Subjects to exercise their rights under Chapter III of the GDPR and equivalent rights under other Data Protection Laws.

If Dviz receives such a request directly, it will promptly forward it to Customer and will not respond itself, other than to direct the Data Subject to Customer, unless Customer authorizes it or the law requires otherwise.

8. Assistance with compliance

Taking into account the nature of the Processing and the information available to Dviz, Dviz will provide Customer with reasonable assistance in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, including security of Processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation with Supervisory Authorities.

9. Personal Data Breaches

Dviz will notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach.

The notification will, to the extent then known, describe the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned; the name and contact details of a contact point at Dviz; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Where information is not yet available, Dviz will provide it in phases without undue further delay.

Dviz will take reasonable steps to contain, investigate and mitigate the Personal Data Breach and will cooperate with Customer. Customer decides whether to notify Supervisory Authorities or Data Subjects. Dviz's notification is not an admission of fault or liability.

10. Return and deletion

On termination or expiry of the Services, Customer may export Customer Data during the thirty (30) day period provided in the Agreement. At the end of that period, Dviz will delete Customer Personal Data, including copies, within thirty (30) days, unless Union, Member State or other applicable law requires its storage. On request, Dviz will confirm the deletion in writing.

Data in backups will be deleted in line with Dviz's backup rotation and, until deleted, will remain protected by this DPA and will not be actively Processed.

11. Information and audits

Dviz will make available to Customer all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer.

Dviz will first meet this obligation by providing its security documentation, policies and completed security questionnaires (including through the Dviz Trust Center) and, where available, third-party audit reports. If this information is not sufficient to demonstrate compliance, or where required by a Supervisory Authority or following a Personal Data Breach, Customer may conduct an audit on at least thirty (30) days' written notice, no more than once in any twelve (12) month period (unless required by a Supervisory Authority or following a Personal Data Breach), during normal business hours, in a way that minimizes disruption and protects the confidentiality and security of other customers' data. Each party bears its own costs, unless the audit reveals a material breach of this DPA by Dviz.

12. International transfers

Dviz may Process Customer Personal Data in the United States and in other countries where Dviz or its Sub-processors operate, subject to this Section. Where Customer deploys Sorgi in its own cloud environment, Customer selects the hosting region.

To the extent the Processing involves a Restricted Transfer, the parties agree that the transfer will be made under the following mechanism, which is incorporated into this DPA by reference:

• EEA transfers: the EU SCCs, Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorization) applies with the notice period in Section 6 of this DPA; the optional wording in Clause 11 does not apply; under Clause 13, the competent Supervisory Authority is determined as set out in Annex I.C; under Clauses 17 and 18, the EU SCCs are governed by the law of, and disputes are resolved by the courts of, Ireland. Annexes I, II and III of this DPA complete the corresponding annexes of the EU SCCs.
• UK transfers: the EU SCCs as amended by the UK Addendum. Table 1 is completed with the parties' details in Annex I; Table 2 with the modules and options selected above; Table 3 with Annexes I to III; and in Table 4 either party may end the UK Addendum as set out in its Section 19.
• Swiss transfers: the EU SCCs, with references to the EU GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority for transfers subject to the FADP, and the term "Member State" interpreted so that Data Subjects in Switzerland can bring claims in their place of habitual residence.

Where a recipient is located in a country, or is certified under a framework (such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions), that is recognized as adequate, the parties may rely on that adequacy instead. If a transfer mechanism is invalidated or replaced, the parties will cooperate to put in place a valid alternative. Dviz will ensure that onward Restricted Transfers to Sub-processors are covered by an appropriate transfer mechanism and supplementary measures.

If there is a conflict between this DPA and the EU SCCs or UK Addendum, the EU SCCs or UK Addendum prevail.

13. U.S. state law terms

To the extent the CCPA or similar U.S. state laws apply, Dviz will:

• not sell or share Customer Personal Data, as those terms are defined in the CCPA;
• not retain, use or disclose Customer Personal Data for any purpose other than the business purposes of providing the Services specified in the Agreement, or as otherwise permitted by the CCPA for service providers and contractors;
• not retain, use or disclose Customer Personal Data outside the direct business relationship between Dviz and Customer;
• not combine Customer Personal Data with personal data it receives from or on behalf of other persons, or collects from its own interactions with consumers, except as permitted by the CCPA;
• comply with the CCPA and provide the same level of privacy protection as the CCPA requires of Customer, and notify Customer if it determines it can no longer meet its obligations.

Customer may take reasonable and appropriate steps to ensure Dviz uses Customer Personal Data consistently with Customer's obligations, and, on notice, to stop and remediate unauthorized use. Dviz certifies that it understands and will comply with these restrictions.

14. Liability, term and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement, except where such limitation is not permitted by Data Protection Laws or the EU SCCs.

This DPA remains in force for as long as Dviz Processes Customer Personal Data on Customer's behalf. If there is a conflict, the following order of precedence applies: (a) the EU SCCs and UK Addendum; (b) this DPA; (c) the Agreement.

Apart from the EU SCCs and UK Addendum, which are governed as set out in Section 12, this DPA is governed by the law that governs the Agreement.

Annex I: Description of the Processing

A. List of parties

Data exporter: the Customer named in the Agreement, acting as Controller (or as Processor on behalf of its controller). Contact details and signature: as set out in the Agreement. Data importer: Dviz Technologies Inc., 16192 Coastal Highway, Lewes, Delaware, USA, info@dviz.tech, acting as Processor (or Sub-processor). Activities relevant to the transfer: provision of the Services. Signature and date: by entering into the Agreement, each party is deemed to have signed this Annex.

B. Description of the transfer and Processing

C. Competent Supervisory Authority

The Supervisory Authority of the EU Member State in which Customer is established or, if Customer is not established in the EU, the Supervisory Authority of the Member State in which Customer's EU representative is established or, failing that, in which the Data Subjects whose Personal Data is transferred are located. For UK transfers, the UK Information Commissioner; for Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational measures

• Encryption: Customer Data is encrypted in transit and at rest.
• Secrets and credentials: enterprise-grade secret management (Vault) so credentials are never exposed in plaintext; token-based (OAuth) access to connected systems without sharing passwords.
• Deployment options: deployment in Customer's own AWS, Azure or GCP environment for data sovereignty.
• Access control: role-based access and least privilege for Dviz personnel, with access monitored and controlled; access to Customer Data limited to personnel who need it to provide the Services.
• AI guardrails: administrator-defined keyword and topic filtering, and system-level guardrails that block restricted data (such as PII and financial data) from being sent to AI models.
• Human oversight and auditability: human-in-the-loop checkpoints configurable by Customer; logging of automated steps so actions are visible and auditable.
• Testing and change management: changes reviewed and approved before release; agents, workflows and applications can be tested before and after deployment.
• Resilience: backups, and business continuity and disaster recovery planning.
• Incident response: a documented incident response process and team.
• Vulnerability management: regular security reviews, vulnerability assessments and continuous monitoring.
• People: confidentiality commitments and security awareness training for all personnel.
• Vendors: security and data protection review of Sub-processors and written data protection terms.

Dviz's policies covering these areas (including access control, encryption, data protection, backup, business continuity, incident response and change management) are available through the Dviz Trust Center.

Annex III: Sub-processors

The current list of Sub-processors, including their location and function, is published in the Dviz Trust Center at https://trust.dviz.tech and is available on request from info@dviz.tech. Customer authorizes the Sub-processors on that list as of the date of the Agreement. Changes follow the procedure in Section 6.