Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of, and is incorporated by reference into, the Timbal AI Terms of Service and any applicable Order Form (together, the “Agreement”) between TIMBAL TECH, S.L. (“Timbal AI”, the “Processor”) and the Customer (the “Controller”).

In the context of the provision of the Services under the Agreement, the Processor may process Personal Data on behalf of the Controller and, accordingly, the Parties wish to regulate such processing in accordance with Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and, where applicable, Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”).

This DPA governs the processing of personal data carried out by Timbal AI on behalf of the Customer in connection with the provision of the Services. This DPA forms an integral part of the Agreement and shall apply for as long as the Processor processes Personal Data on behalf of the Controller. Capitalized terms not defined herein have the meaning given to them in the Agreement. In the event of a conflict between this DPA and the Agreement regarding the processing of personal data, this DPA shall prevail.

Purpose

The purpose of this DPA is to authorize the Processor to process, on behalf of the Controller, the personal data necessary to provide the Services, and to define the conditions under which the Processor will process the personal data to which it has access during the provision of the Services, establishing the obligations and responsibilities arising from the processing carried out by the Processor exclusively for, and in connection with, the performance of the Agreement.

Description of the processing

The details of the processing operations — in particular the categories of data subjects, the categories of personal data and the purposes for which the personal data are processed on behalf of the Controller — are set out in Appendix I below. The list of authorized sub-processors is published on the Sub-processors page, which constitutes Appendix II to this DPA.

Obligations of the parties

Instructions

(a) The Processor will process personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law to which the Processor is subject. In such a case, the Processor will inform the Controller of that legal requirement before processing, unless that law prohibits it on important grounds of public interest. The Controller may also give further instructions at any time during the processing of the personal data. Such instructions must always be documented.

(b) Notwithstanding the foregoing, the Controller expressly authorizes the Processor to process personal data for the purpose of improving, maintaining and optimizing the SaaS Services, including error correction, performance improvement, security, scalability and the development or evolution of functionalities directly related to the Services provided to the Controller, in all cases without altering the principal purposes of the processing.

(c) The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions.

Purpose limitation

The Processor will process personal data only for the specific purposes of the processing set out in Appendix I and in accordance with the documented instructions of the Controller. In no case will it process personal data for its own purposes other than those expressly authorized in this DPA, nor for purposes other than those arising from the provision of the Service.

Duration of the processing and fate of the data

Processing by the Processor will be carried out only for the period specified in the Agreement, without prejudice to any legal grounds requiring the Processor to process personal data in blocked form in order to respond to its legal obligations or liabilities. Once the authorized processing has ended, the Processor will delete the personal data once the Services have been completed. Nevertheless, the Processor may retain a copy, with the data duly blocked, for as long as liabilities may arise from the performance of the Services. Export and post-termination retention are also governed by Section 17 (Data Retention, Export and Portability) of the Terms of Service.

Record of processing activities

The Processor undertakes to keep, in writing, a record of all categories of processing activities carried out on behalf of the Controller, containing at least the information required by Article 30(2) of the GDPR.

Security of processing

The Processor undertakes to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing of personal data carried out on behalf of the Controller, in accordance with Article 32 of the GDPR. To this end, the Processor operates an Information Security Management System (ISMS) implemented in accordance with the ISO/IEC 27001:2022 standard, which constitutes its reference framework for information security management. That framework includes, among others, measures relating to access control, data encryption, vulnerability management, incident response, internal audit and personnel training.

When determining the appropriate level of security, the parties will take due account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons. Upon request, the Processor will make available to the Controller documentation evidencing the implemented security measures. The Processor will ensure that access to personal data is limited to authorized personnel strictly to the extent necessary for the provision of the Services, and that such personnel are subject to appropriate confidentiality obligations.

Documentation and compliance

(a) The Parties must be able to demonstrate compliance with this DPA.

(b) The Processor will deal promptly and adequately with the Controller’s enquiries about the processing under this DPA.

(c) The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations under this DPA and arising directly from the GDPR. At the Controller’s request, the Processor will allow for and contribute to audits of the processing activities covered by this DPA, at reasonable intervals or where there are indications of non-compliance. In deciding whether to carry out a review or audit, the Controller will take into account any relevant certifications held by the Processor.

(d) The Controller may choose to carry out the audit itself or to mandate an independent auditor. In any case, the Controller will bear the cost of such audits and will compensate the Processor for disruptions to the normal operation of its business that such audits may cause. Audits may also consist of inspections of the Processor’s premises or physical facilities and, where appropriate, will be carried out with reasonable prior notice.

Assistance to the Controller

(a) The Processor will notify the Controller, promptly and in no case later than seven (7) calendar days following receipt, of any requests from data subjects to exercise their rights. The Processor will not respond to such requests itself unless authorized to do so by the Controller.

(b) Taking into account the nature of the processing, the Processor will assist the Controller in fulfilling its obligation to respond to requests for the exercise of data subjects’ rights. In fulfilling its obligations under points (a) and (b), the Processor will comply with the Controller’s instructions.

(c) In addition, taking into account the nature of the processing and the information available to it, the Processor will assist the Controller in ensuring compliance with the following obligations:

1. the obligation to carry out a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons; and

2. the obligation to consult the competent supervisory authorities prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Controller to mitigate it.

Personal data breach notification

In the event of a personal data breach, the Processor will cooperate with and assist the Controller in complying with its obligations under Articles 33 and 34 of the GDPR, taking into account the nature of the processing and the information available to the Processor.

In the event of a breach affecting personal data processed by the Processor on behalf of the Controller, the Processor will notify the Controller without undue delay and, in any case, within a maximum of forty-eight (48) hours of becoming aware of the breach. The Processor will also assist the Controller in:

(a) notifying the personal data breach to the competent supervisory authorities without undue delay, where applicable (unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons);

(b) obtaining the information that, under Article 33(3) of the GDPR, must appear in the Controller’s notification, including at least the nature of the personal data and, where possible, the categories and approximate number of data subjects and personal data records affected;

(c) where the information cannot be provided at the same time, providing the available information in the initial notification and the remaining information without undue delay as it is collected; and

(d) complying, under Article 34 of the GDPR, with the obligation to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons.

Sub-processing

(a) The Processor is authorized to engage sub-processors that involve the processing of personal data. The sub-processors already authorized by the Controller are listed on the Sub-processors page (Appendix II).

(b) To engage additional sub-processors, the Processor will notify the Controller in writing, clearly and unambiguously identifying the sub-processor and its contact details. The engagement may proceed if the Controller does not object within eight (8) calendar days.

(c) In all cases, processing by the sub-processor must comply with the Controller’s instructions. The Processor will enter into a contract with the sub-processor on terms consistent with this DPA and Article 28 of the GDPR, requiring the sub-processor to assume, expressly and in writing, obligations identical or compatible with those of the Processor. Where the sub-processor fails to fulfil its data protection obligations, the Processor remains fully liable to the Controller for compliance.

International transfers

(a) Transfers of data to a third country or international organization by the Processor may only be carried out following documented instructions from the Controller or under an express requirement of Union or Member State law to which the Processor is subject, and will be carried out in accordance with Chapter V of the GDPR.

(b) The Controller agrees that, where the Processor engages a sub-processor under Section 6 to carry out specific processing activities (on behalf of the Controller) and those activities involve a transfer of personal data within the meaning of Chapter V of the GDPR, the Processor and the sub-processor may ensure compliance with Chapter V by using standard contractual clauses adopted by the Commission under Article 46(2) of the GDPR, or other valid mechanisms under applicable law, provided that the conditions for their use are met.

Limitation of liability

The Processor will not be liable for infringements of data protection law arising directly or indirectly from acts or omissions attributable to the Controller.

In no case will the Processor be liable to third parties other than the Controller and, unless otherwise expressly provided in the Agreement, the Processor’s total liability to the Controller will be limited to the amount of the fees actually paid by the Controller to the Processor during the last calendar year immediately preceding the act giving rise to the contractual damage, without prejudice to any liability that may arise under applicable data protection law.

This limitation does not apply in cases of fraud, wilful misconduct or gross negligence, nor where the damages arise from a breach of payment obligations, misuse of the platform, or a breach of the confidentiality or intellectual property obligations set out in the Agreement. In no case will either party be liable to the other for indirect, special or consequential damages, including loss of profits, loss of data or business interruption, except to the extent such liability is mandatory under applicable law.

Indemnity

Each party will indemnify and hold the other harmless against any claim, damage, loss, penalty or cost (including reasonable legal fees) arising from a breach of its obligations under this DPA or under applicable law. The foregoing does not apply where the damages result from the wilful misconduct or gross negligence of the party seeking to invoke the indemnity.

Appendix I — Description of the Processing

Categories of data subjects whose personal data is processed:

• Employees

• Customers

• Web users

• Other: platform users

Categories of personal data processed (the examples given for each category are illustrative only):

• Identifying data (for example, name and surname, email address, telephone number or user identifiers).

• Transactions in goods and services (for example, records of the services contracted and their use).

• Economic and financial data (for example, billing information or payment details).

• Commercial information (for example, information relating to the commercial relationship with the Customer).

Special categories of data: No special categories of personal data are processed.

Nature of the processing: collection, extraction, storage, structuring, recording, consultation, interconnection, adaptation or modification, use, erasure and destruction.

Purpose(s) of the processing on behalf of the Controller: To enable the use of the Timbal AI platform by the Customer and its users, and the correct provision of the associated SaaS Services, including the operation, maintenance, technical support, incident resolution and operational assistance of the platform. Processing is also carried out in the context of process management and automation, data analysis and the execution of operational flows arising from the contracted Services.

Duration of the processing: For the term of the Agreement. Once terminated, data may be retained for the period necessary to allow Customer to retrieve or export it and, thereafter, will be deleted or kept duly blocked where necessary to comply with legal obligations and to address potential liabilities.

Appendix II — Sub-processors

The authorized sub-processors are listed on the Sub-processors page, available at https://www.timbal.ai/legal/subprocessors, which forms part of this DPA.

Contact Information

TIMBAL TECH SL (Timbal AI)

VAT ID: B19934314

Carrer de Pere IV, 105, 109, Sant Martí, 08018 Barcelona

Email: privacy@timbal.ai

(Questions about this Data Processing Addendum may be directed to Timbal AI at the email address above. Data subjects may also lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.)