Data Processing Agreement

Version: 1.1

This Data Processing Agreement ("DPA") forms part of, and is subject to, the AuditBadger Terms and Conditions governing the provision of the AuditBadger platform and related services (the "Agreement") between the parties identified below. It governs the Processing of Personal Data by the Processor on behalf of the Controller and, in Section 6, how each party protects the other's confidential information, whether or not it contains Personal Data. Section 13 sets out how the Customer can leave the Service and take its data with it. By accepting the Agreement, the Customer and AuditBadger are bound by this DPA, which is incorporated into the Agreement by reference; a signature on this DPA is not required for it to take effect.

1. The Parties

Controller ("Customer")

Processor ("AuditBadger")

Document date: October 20, 2026

2. Definitions

Terms not defined here have the meaning given in the Agreement or in the EU General Data Protection Regulation 2016/679 ("GDPR").

• "Applicable Data Protection Law" means the GDPR and any national laws implementing or supplementing it that apply to the Processing under this DPA, and — where relevant under Section 8.5 — the UK GDPR (the retained EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland) and the Swiss Federal Act on Data Protection ("FADP").
• "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority", and "Personal Data Breach" have the meanings given in the GDPR.
• "Customer Personal Data" means Personal Data that the Processor Processes on behalf of the Controller under the Agreement, as described in Annex 1.
• "Customer Confidential Information" has the meaning given in Section 6.1.
• "Customer Data" means all data that the Customer and its users enter, upload, sync, or generate in the Service, including Customer Personal Data and Customer Confidential Information. It does not include the material described in Section 6.4(d).
• "AuditBadger Confidential Information" has the meaning given in Section 6.7.
• "Service" has the meaning given in the Agreement and includes the AuditBadger platform's web interface, API, and MCP server.
• "Sub-processor" means any third party engaged by the Processor to Process Customer Personal Data.
• "Standard Contractual Clauses" ("SCCs") means the clauses adopted by the European Commission in Decision (EU) 2021/914 for the transfer of Personal Data to third countries.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

3. Roles and Scope

3.1 For Customer Personal Data, the Customer is the Controller and AuditBadger is the Processor. The Customer may itself be acting as a processor for a third-party controller; in that case the Customer warrants it has the authority to engage AuditBadger on those terms.

3.2 AuditBadger Processes Customer Personal Data only to provide the AuditBadger platform and the services described in the Agreement, and as further described in Annex 1.

3.3 This DPA does not apply to Personal Data for which AuditBadger acts as a controller (for example, AuditBadger's own account-administration, billing, and security-log data, its records of who accepted the Agreement and when, and the business contact details of the Customer's representatives), which is governed by AuditBadger's privacy notice.

3.4 One point of contact. AuditBadger takes instructions, requests, and audits under this DPA from the Customer only, not from the Customer's affiliates or from any third-party controller the Customer acts for. Where the Customer's affiliates use the Service through the Customer's account, the Customer accepts this DPA on their behalf as well, and only the Customer may bring a claim under it, for itself and for them.

3.5 Business customers only. The Service is offered to companies and other organisations only, not to natural persons. The Customer confirms that it is a company or other organisation and that it accepts this DPA in the course of its business.

4. Processor Obligations

AuditBadger shall:

4.1 Process only on documented instructions. Process Customer Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless required to act otherwise by EU or Member State law (in which case AuditBadger will inform the Controller of that legal requirement before Processing, unless the law prohibits this). The Agreement, this DPA, and the Customer's configuration and use of the Service are the Controller's complete documented instructions; any additional instruction requires the written agreement of both parties.

4.2 Notify unlawful instructions. Inform the Controller promptly if, in AuditBadger's opinion, an instruction infringes Applicable Data Protection Law. AuditBadger may pause that instruction until the Controller confirms or changes it, and is not required to check instructions for legal compliance or to give legal advice.

4.3 Confidentiality. Ensure that persons authorised to Process Customer Personal Data are bound by an appropriate duty of confidentiality.

4.4 Security. Implement and maintain the technical and organisational measures set out in Annex 2, appropriate to the risk.

4.5 Sub-processing. Engage Sub-processors only in accordance with Section 7.

4.6 Assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to Data Subject requests under Chapter III of the GDPR (Articles 12–23). The Controller can access, correct, export, and delete Customer Personal Data using the functions of the Service and will use those functions first. If a Data Subject sends a request to AuditBadger directly, AuditBadger will pass it to the Controller where it can tell which customer the request concerns, and will not answer it itself beyond referring the person to the Controller.

4.7 Assist with compliance. Assist the Controller in ensuring compliance with its obligations under Articles 32–36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to AuditBadger.

4.8 Deletion or return. At the Controller's choice, delete or return all Customer Personal Data after the end of the provision of services, and delete existing copies unless EU or Member State law requires storage (see Section 13).

4.9 Demonstrate compliance. Make available to the Controller the information necessary to demonstrate compliance with Article 28 of the GDPR, and allow for and contribute to audits in accordance with Section 10.

5. Customer Responsibilities

5.1 The Customer is responsible for its own compliance with Applicable Data Protection Law as Controller. In particular, the Customer confirms that:

(a) it has a legal basis for the Customer Personal Data it enters, uploads, or syncs into the Service, and has given the people concerned the information the law requires;

(b) its instructions to AuditBadger, including the way it configures and uses the Service and the services it connects, comply with the law;

(c) it has reviewed the measures in Annex 2 and considers them appropriate for the Customer Personal Data it chooses to Process in the Service; and

(d) it will not submit data that Section 11 excludes.

5.2 Accounts and credentials. The Customer decides who has access to its workspace, keeps its users' log-ins, API keys, and tokens secure, and uses the security settings the Service offers. Anything done in the Service with those log-ins, keys, or tokens, including by integrations, API clients, MCP clients, or AI agents the Customer authorises, is treated as done by the Customer and on its instructions, unless they were compromised through AuditBadger's breach of this DPA.

5.3 Channels outside the Service. The Service is where Customer Personal Data belongs. If the Customer sends Customer Personal Data to AuditBadger another way, for example by email, in a shared chat channel, or on a call, it will share only what its request needs. AuditBadger Processes that data under this DPA to handle the request.

5.4 If the Customer does not meet these responsibilities. To the extent a third party (including a Data Subject) brings a claim against AuditBadger, or AuditBadger incurs a cost, because the Customer did not meet its responsibilities under this Section or Section 11, the Customer will cover the claim and AuditBadger's reasonable costs. This includes anything AuditBadger has to pay a Data Subject for damage the Customer is responsible for (Article 82(5) of the GDPR), and applies in addition to the indemnity in the Agreement.

6. Confidentiality

6.1 The Customer's information. This Section applies to all non-public information submitted, uploaded, collected, generated, or otherwise made available by the Customer through the Service, including audit information, controls, evidence, policies, security information, risk assessments, and supporting documentation ("Customer Confidential Information"), whether or not it contains Personal Data.

6.2 AuditBadger will use Customer Confidential Information solely as necessary to provide, secure, and support the Service, to comply with the law, and to establish, exercise, or defend legal claims. It will protect Customer Confidential Information with the measures set out in Annex 2 and with at least the same care it gives its own confidential information. AuditBadger does not use Customer Confidential Information to train AI models, and engages AI service providers only on terms that do not allow them to do so. Section 4 also applies to any Customer Personal Data it contains.

6.3 AuditBadger will not disclose Customer Confidential Information to any third party except:

(a) to its personnel, professional advisers, auditors, and Sub-processors and other service providers who need it for the purposes in Section 6.2 and are bound by written confidentiality or data-protection obligations appropriate to their role;

(b) as the Customer directs or enables through the Service, for example to users, auditors, integrations, API clients, MCP clients, or AI agents the Customer authorises;

(c) where disclosure is required by law or by an order of a court or authority, in which case AuditBadger will, where legally permitted, notify the Customer before disclosing; or

(d) to its insurers and to courts or authorities, as far as needed to establish, exercise, or defend legal claims.

AuditBadger remains responsible for the handling of Customer Confidential Information by the recipients in (a), subject to Section 12. Within the Service, the only service providers that store or process Customer Confidential Information are the Sub-processors on the list in Section 7.2, including the AI service providers. Sections 7.3 and 7.4 apply to Customer Confidential Information in the same way as to Customer Personal Data, whether or not it contains Personal Data.

6.4 Customer Confidential Information does not include information that:

(a) is or becomes public other than through AuditBadger's breach;

(b) AuditBadger already held, or receives from a third party, without a duty of confidentiality;

(c) AuditBadger develops independently; or

(d) forms part of AuditBadger's own frameworks, control libraries, templates, and platform content.

6.5 AuditBadger's obligations under Sections 6.2 and 6.3 continue for as long as AuditBadger holds Customer Confidential Information and for three years after the Agreement ends, and for trade secrets for as long as they remain trade secrets.

6.6 Tools and services that the Customer connects to the Service, or that access it using credentials, API keys, or tokens issued by the Customer, including MCP clients and AI agents, are not AuditBadger's Sub-processors or service providers. The Customer is responsible for those credentials and for its own arrangements with the providers of such tools (see also Section 5.2). AuditBadger's obligations under this Section do not extend to Customer Confidential Information once it has been transmitted to them.

6.7 AuditBadger's information. The following non-public information is "AuditBadger Confidential Information":

(a) security and compliance documentation that AuditBadger provides, including the reports under Section 10.1;

(b) the results of an audit under Section 10.3 and anything the Customer or its auditor learns in the course of it;

(c) information about unreleased features and AuditBadger's plans;

(d) any terms AuditBadger agrees with the Customer individually; and

(e) any other information AuditBadger marks as confidential when sharing it.

The exceptions in Section 6.4(a) to (c) apply in the same way, with the roles reversed.

6.8 The Customer will use AuditBadger Confidential Information only to evaluate and use the Service. It will protect it with at least the same care it gives its own confidential information, and never less than reasonable care. It will share it only with its personnel, affiliates, professional advisers, and auditors who need it for that purpose and are bound by confidentiality duties, or where the law or an order of a court or authority requires it (telling AuditBadger first, where legally permitted). The Customer remains responsible for how they handle it.

6.9 The Customer's obligations under Sections 6.7 and 6.8 last for the term of the Agreement and for three years after it ends, and for trade secrets for as long as they remain trade secrets. If the Customer accepted a separate confidentiality agreement to receive a document, for example in AuditBadger's trust center, that agreement applies to the document as well.

7. Sub-processors

7.1 The Controller provides general written authorisation for AuditBadger to engage Sub-processors to Process Customer Personal Data, subject to this Section.

7.2 A current list of Sub-processors is maintained at:

https://auth.auditbadger.com/legal/data-processors

Services the Customer connects itself (Section 7.5) are not Sub-processors, even where that page describes them for information.

7.3 AuditBadger engages each Sub-processor under a written contract, which may be the Sub-processor's standard data processing terms, that imposes data protection obligations which are in substance no less protective than those in this DPA, in particular regarding security and the requirements of Article 28(3) of the GDPR. AuditBadger remains fully liable to the Controller for the performance of each Sub-processor's obligations, subject to Section 12. A Sub-processor may use its own sub-processors under those terms; they are shown in the Sub-processor's own published documentation, and Section 7.4 applies only to Sub-processors that AuditBadger engages directly.

7.4 AuditBadger will notify the Controller of any intended addition or replacement of a Sub-processor at least 14 days before the change takes effect, by email to the Controller's contact email address (Section 14.2), and will update the list at the URL above. The Controller may object within that period, in writing and on reasonable data-protection grounds. If the Controller does not object within that period, it is treated as having accepted the change. If the Controller objects and the parties cannot resolve the objection, the Controller may terminate the Agreement with immediate effect by written notice. Termination is the Controller's only remedy for an objection, and fees already paid are not refunded. Where a Sub-processor must be replaced urgently to protect the security or availability of the Service, AuditBadger may make the change sooner and will notify the Controller without undue delay; the Controller's right to object and terminate is unaffected.

7.5 Customer-connected third-party services. Where the Customer chooses to connect a third-party service to the AuditBadger platform (for example Google Workspace, Microsoft 365, AWS, Google Cloud Platform, Linear, Shortcut, Vercel, or similar integrations, and API clients, MCP clients, or AI agents that access the platform using credentials or tokens issued by the Customer), the provider of that service is not a Sub-processor under this DPA. The Customer acts as controller of the data it directs to and from those services and is responsible for its own agreements with those providers. Where AuditBadger ingests and stores data from such a connected service on its own infrastructure (for example, a list of user accounts retained as compliance evidence), that stored data is Customer Personal Data and is Processed under this DPA and secured by the Sub-processors named in the list referenced in Section 7.2.

8. International Transfers

8.1 AuditBadger is established in Poland. AuditBadger will not transfer Customer Personal Data outside the European Economic Area ("EEA") unless it has taken measures necessary to ensure the transfer is compliant with Applicable Data Protection Law.

8.2 Transfers to Sub-processors. Certain Sub-processors are established, or process Customer Personal Data, outside the EEA, including in the United States (for example, content-delivery/DNS, AI, and electronic-signature service providers, as identified in the Sub-processor list). The Controller instructs AuditBadger to make these transfers. For them, AuditBadger relies on one or more of the following:

(a) a European Commission adequacy decision applicable to the recipient (including, where applicable and valid, the recipient's self-certification under the EU-U.S. Data Privacy Framework); or

(b) the Standard Contractual Clauses (SCCs) applicable to that transfer under AuditBadger's contract with the Sub-processor (Module Three: processor-to-processor), together with any supplementary measures required following a transfer impact assessment.

8.3 Customers outside the EEA. Where the Customer is established outside the EEA and is not covered by a European Commission adequacy decision (including, for Customers in the United States, a valid self-certification under the EU-U.S. Data Privacy Framework), AuditBadger making Customer Personal Data available to the Customer is a transfer from a processor to a controller. For those transfers, the SCCs (Module Four: processor-to-controller) are incorporated into this DPA by reference and completed as set out in Annex 3, with AuditBadger as data exporter and the Customer as data importer.

8.4 Where the SCCs apply and there is a conflict between them and this DPA, the SCCs prevail in respect of the relevant transfer.

8.5 United Kingdom and Switzerland. Where the Customer is established in the United Kingdom or Switzerland, transfers of Customer Personal Data between the Customer and AuditBadger rely on the adequacy decisions and regulations in force between those countries and the EEA. If such a basis ceases to apply to a transfer, the parties will put in place the transfer mechanism required by the applicable law (for the United Kingdom, the SCCs with the UK Addendum; for Switzerland, the SCCs with the adaptations required by the FADP). All other terms of this DPA apply equally to Customer Personal Data subject to the UK GDPR or the FADP.

8.6 Where the infrastructure is. The Sub-processor list at the URL in Section 7.2 shows where the infrastructure used for the Service is located and which safeguards apply.

9. Personal Data Breach

9.1 AuditBadger will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. AuditBadger becomes aware when it has established with reasonable certainty that Customer Personal Data has been affected; it will look into signs of a possible breach without undue delay.

9.2 The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it. Where the information cannot all be provided at once, it may be provided in phases without undue further delay.

9.3 AuditBadger sends the notification to the Controller's contact email address (Section 14.2).

9.4 AuditBadger will reasonably assist the Controller in meeting the Controller's own breach-notification obligations to Supervisory Authorities and Data Subjects (see Section 10.2).

9.5 A notification under this Section is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked log-in attempts or network scans, are not Personal Data Breaches.

10. Information, Assistance and Audit

10.1 Standard materials. AuditBadger will make available to the Controller the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR. It does so primarily through its standard materials: this DPA, the Sub-processor list, its security documentation, and its current independent audit reports and certifications, which at the date of this version include a SOC 2 Type II report. These reports and certifications are listed in AuditBadger's trust center and are made available to the Controller on request under confidentiality (see Sections 6.7 and 6.8).

10.2 Further help. Where the Controller needs help beyond the functions of the Service and the standard materials (for example answers to its own questionnaires, support for a data protection impact assessment, or the assistance described in Sections 4.6, 4.7, and 9.4), AuditBadger will provide what is reasonable, taking into account the nature of the Processing and the information available to it. AuditBadger may charge a reasonable fee for its time, which it will tell the Controller before starting, except where the help is needed because AuditBadger breached this DPA.

10.3 Audit. Where the standard materials are not sufficient, the Controller will first tell AuditBadger in writing what further information it needs and why, and AuditBadger will try to provide it. If that is still not sufficient, the Controller (or a mutually agreed independent auditor) may audit AuditBadger's compliance with this DPA on the following conditions:

(a) the Controller gives at least 30 days' prior written notice, and audits take place no more than once per twelve-month period, except where required by a Supervisory Authority or following a Personal Data Breach affecting the Controller's data;

(b) the parties agree the scope, timing, and duration in advance; audits are conducted remotely, during AuditBadger's business hours and with minimal disruption, and take no more than one business day unless the parties agree otherwise;

(c) an auditor must not be a competitor of AuditBadger and must sign a confidentiality agreement with AuditBadger before the audit starts;

(d) audits do not extend to other customers' data, to information AuditBadger has to keep confidential for others, or to Sub-processors' facilities (for Sub-processors, AuditBadger will share the audit reports and certifications available to it), and do not include scanning or testing AuditBadger's systems unless AuditBadger has agreed to this in writing;

(e) the Controller bears the cost of the audit, including a reasonable fee for AuditBadger's time, unless the audit shows that AuditBadger materially breached this DPA; and

(f) the Controller gives AuditBadger a copy of the results, which are AuditBadger Confidential Information.

10.4 Incidents affecting several customers. After a Personal Data Breach that affects several customers, AuditBadger will give the affected customers a written incident report. Audits requested because of that breach may be combined into a single audit whose results are shared with every customer that asked for one.

10.5 Nothing in this Section limits the powers of a Supervisory Authority.

11. Special Categories of Personal Data

11.1 The AuditBadger platform is not intended to Process special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR).

11.2 The Controller shall not upload, sync, or otherwise submit such data to the platform unless separately agreed in writing with AuditBadger. The Controller is responsible for ensuring that evidence and other content it provides is limited to the minimum Personal Data necessary for its compliance purposes. Records confirming only that a background check or similar screening was carried out, without its results, are not restricted by this Section.

11.3 If the Controller submits such data without that agreement, AuditBadger owes no duties for it beyond those that apply to other Customer Personal Data, and the Controller is responsible for the consequences. AuditBadger may ask the Controller to remove the data and, if the Controller does not, may remove it itself after giving notice.

11.4 Incident reports. The Service lets people report incidents, including anonymously. The reporter decides what to write, so a report may contain data of the kind described in Section 11.1, for example about the people it names. Sections 11.2 and 11.3 do not apply to what a reporter writes in an incident report. The Controller decides what the reporting function is used for and who can see the reports, is responsible for having a legal basis for the data they contain, and removes data that is not needed to handle a report. AuditBadger Processes incident reports like other Customer Personal Data.

12. Liability

12.1 The liability of each party under or in connection with this DPA, including under Section 6 (Confidentiality) and Section 7.3 (Sub-processors), is subject to the limitations and exclusions of liability set out in the Agreement, whatever the legal basis of the claim, including recourse claims between the parties under Article 82(5) of the GDPR. Any statement in this DPA that a party is liable or responsible is to be read subject to this Section.

12.2 In plain terms. At the date of this version, the Agreement provides that AuditBadger is liable to the Customer only for damage it causes intentionally. Where the law does not allow that rule to apply, the Agreement limits AuditBadger's total liability to the fees the Customer paid in the twelve months before the event giving rise to the claim, except where the law does not allow liability to be limited. The "Liability and indemnification" section of the Agreement contains the full rules and prevails over this summary. The limits apply once to the Customer and its affiliates together.

12.3 Nothing in this Section limits a Data Subject's rights under Applicable Data Protection Law, or any liability that cannot be limited or excluded under mandatory law.

12.4 Where the SCCs apply, this Section governs liability between the parties to the extent the SCCs allow, and does not limit what either party owes to Data Subjects under the SCCs.

13. Term, Leaving the Service, Return and Deletion

13.1 This DPA takes effect when the Customer accepts the Agreement or, for a Customer that accepted an earlier version, when this version takes effect under the Agreement. It continues for as long as AuditBadger Processes Customer Personal Data or holds Customer Confidential Information under the Agreement. Sections 6, 12, and 14 continue to apply after that, Section 6 for the periods stated in Sections 6.5 and 6.9.

13.2 Leaving the Service. Subscriptions are monthly. The Customer may cancel at any time in the Service, or by written notice, whether to move to another provider, to move its Customer Data to its own systems, or to have its Customer Data deleted. The Agreement then ends at the end of the current monthly period, and AuditBadger confirms the end date to the Customer.

13.3 Until the Agreement ends. AuditBadger keeps providing the Service and keeps the measures in Annex 2 in place. The export functions let the Customer take out all its Customer Data without delay, and in any case within 30 days of its notice. AuditBadger gives the Customer, and anyone the Customer authorises, reasonable help with the export and the information the Customer needs to plan its move, and tells the Customer about any risk to the continuity of the Service that it knows of. A Customer that needs more time to move can keep its subscription active for as long as it needs.

13.4 Retrieval period. For at least 30 days after the Agreement ends, however it ended, AuditBadger keeps the Customer Data and, on request, makes an export available to the Customer, unless the law prevents this. Exporting is how Customer Personal Data is returned.

13.5 Deletion. After the retrieval period, and no later than 60 days after the Agreement ends, AuditBadger deletes all Customer Data from its production systems, unless EU or Member State law requires continued storage. A Customer that has not asked for an export during the retrieval period is treated as having chosen deletion. The Customer may ask in writing for earlier deletion, which ends the retrieval period; AuditBadger carries out such a request within 30 days.

13.6 Backups. Copies held in backups are overwritten or deleted in the ordinary course of AuditBadger's backup-rotation cycle, at the latest 30 days after deletion under Section 13.5. Until then they remain protected under this DPA and are used only to restore the Service or the Customer's own data. Residual copies in Sub-processors' logs are deleted under those Sub-processors' own retention terms.

13.7 What can be exported, and at what cost. The export functions cover all Customer Data: every record, document, and file in the Customer's workspace. The data categories and export formats are described in the Service documentation. AuditBadger's own frameworks, control libraries, templates, and platform content (Section 6.4(d)) are not Customer Data and are not exported, though the Customer's own content built with them is. AuditBadger does not charge for the export, for its help under Section 13.3, for the retrieval period, or for deletion.

13.8 Accounts that never started a subscription. Where no paid subscription was ever activated on an account, AuditBadger may delete the account and its Customer Data seven days after the account was created. Sections 13.2 to 13.4 do not apply to such an account; Section 13.6 does.

14. General

14.1 In the event of a conflict between this DPA and the rest of the Agreement on data protection matters, on confidentiality under Section 6, or on leaving the Service under Section 13, this DPA prevails. This does not affect Section 12, which applies in all cases.

14.2 Notices. AuditBadger sends notices under this DPA by email to the contact email address the Customer has provided (Section 1, or as the Customer has since updated it in the Service or by notice to AuditBadger). The Customer keeps that address current. A notice counts as given when AuditBadger sends it to that address. The Customer sends notices to AuditBadger at the data protection contact in Section 1.

14.3 Changes made by the Customer. This DPA is offered on standard terms. Changes, additions, or deletions that the Customer makes to it, including on a signed copy, have no effect unless AuditBadger has expressly agreed to them in a separate document signed by its authorised representative, by hand or electronically. AuditBadger's silence, or its continuing to provide the Service, is not acceptance of a change the Customer proposes; Article 68² of the Polish Civil Code does not apply.

14.4 This DPA is governed by the laws of Poland, without prejudice to any mandatory provisions of Applicable Data Protection Law. The courts referred to in the Agreement have jurisdiction.

14.5 If any provision is found invalid, the remainder of the DPA remains in effect.

14.6 Updates. AuditBadger may update this DPA for a valid reason, such as a change in the law or in regulators' guidance, a change to the Service or its Sub-processors, or a security improvement. It does so under the change provisions of the Agreement: with advance notice, and with the Customer free to cancel without penalty. A Customer that cancels within the notice period stays on the previous version until its subscription ends. The version currently published by AuditBadger replaces earlier versions, including any signed copy of an earlier version.

15. Acceptance and Optional Signature

This DPA is incorporated into the Agreement by reference and takes effect when the Customer accepts the Agreement. No signature is required for it to be binding on either party.

The Customer may, at its option, sign below to retain a counter-signed record. Doing so does not change the effective date or the binding nature of this DPA, or AuditBadger's right to update it under Section 14.6. Section 14.3 applies to any change made on a signed copy.

Customer — Customer legal name

Name: Authorized signer Title: Signer title Date: October 20, 2026 Signature: _______________________________

For and on behalf of the Processor, Prograils Sp. z o.o. — accepted and made available through the AuditBadger platform; no manual signature required.

Annex 1 — Description of Processing

Annex 2 — Technical and Organisational Measures

AuditBadger maintains the following measures, appropriate to the risk (Article 32 GDPR). They apply to Customer Personal Data and, under Section 6, to Customer Confidential Information:

• Access control — role-based access, unique credentials, and least-privilege principles for systems Processing Customer Personal Data.
• Authentication — enforced strong authentication for administrative access to production systems.
• Encryption — encryption in transit (TLS), and encryption at rest of the application database, stored files, and backups.
• Network security — segregation of production environments, firewalling, and restricted ingress.
• Logging and monitoring — security event logging and monitoring of production systems.
• Backups — regular backups with defined retention and rotation.
• Change management — version control, automated code review, and continuous-integration checks prior to deployment.
• Vulnerability management — patching and remediation of identified vulnerabilities.
• Personnel — confidentiality obligations and security-awareness measures for staff.
• Sub-processor management — contractual data-protection obligations in place with all Sub-processors.
• Resilience — measures to restore availability and access to Customer Personal Data in a timely manner after an incident.

These measures are reviewed periodically and may be updated provided the overall level of security is not materially reduced.

Annex 3 — Standard Contractual Clauses: Elections and Completion

This Annex completes the Standard Contractual Clauses ("SCCs") incorporated by reference under Section 8.3. It applies only where the Customer is established outside the EEA and is not covered by an adequacy decision.

1. Module in operation. Module Four (processor-to-controller) applies, with AuditBadger as data exporter and the Customer as data importer.

2. Clause 7 — Docking clause. The optional docking clause applies.

3. Clause 11 — Redress. The optional independent dispute-resolution body language does not apply.

4. Clause 17 — Governing law. The SCCs are governed by the law of Poland.

5. Clause 18 — Choice of forum and jurisdiction. Disputes arising from the SCCs are resolved before the courts of Poland, consistent with Section 14.4.

6. Annexes to the SCCs.

   • Annex I.A (List of Parties): AuditBadger as data exporter (processor) and the Customer as data importer (controller), each as identified in Section 1 of this DPA.
   • Annex I.B (Description of Transfer): as set out in Annex 1 of this DPA.
   • Annex II (Technical and Organisational Measures): to the extent applicable to Module Four, as set out in Annex 2 of this DPA.

7. Transfers to Sub-processors. For transfers under Section 8.2, the SCCs (Module Three) are completed in AuditBadger's contracts with the relevant Sub-processors and do not form part of this Annex.

8. Precedence. Where there is a conflict, the order of precedence is: (1) the SCCs; (2) this Annex 3; (3) the remainder of this DPA.