Data Processing Agreement (DPA)

Between:

• Data Controller: the customer named in the order form or services agreement ("Controller" or "Client")
• Data Processor: Cognitiva Systems Inc. ("Processor" or "Cognitiva")

RECITALS#

WHEREAS:

A. Controller has entered into an agreement with Processor for the provision of CognitivaOS platform services ("Services Agreement");

B. In providing Services, Processor will process Personal Data on behalf of Controller;

C. The parties wish to ensure such processing complies with applicable Data Protection Laws;

D. This Data Processing Agreement ("DPA") governs Processor's obligations regarding Personal Data processing.

NOW THEREFORE, the parties agree as follows:

1.DEFINITIONS AND INTERPRETATION#

1.1 Definitions#

"Data Protection Laws" means all applicable laws relating to the processing of Personal Data, including:

• EU General Data Protection Regulation (GDPR) (Regulation 2016/679)
• UK Data Protection Act 2018 and UK GDPR
• California Consumer Privacy Act (CCPA) as amended by CPRA
• Other applicable privacy laws in jurisdictions where Services are provided

"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws.

"Processing" has the meaning given in applicable Data Protection Laws.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Sub-processor" means any third party appointed by Processor to process Personal Data on Controller's behalf.

"Standard Contractual Clauses" (SCCs) means:

• EU SCCs: Commission Implementing Decision 2021/914
• UK IDTA: UK International Data Transfer Addendum

"Supervisory Authority" means the relevant data protection regulatory authority.

1.2 Interpretation#

• Terms not defined here have meanings in Services Agreement
• Headings are for convenience only
• References to "include" mean "include without limitation"

2.SCOPE AND ROLES#

2.1 Controller Role#

Controller:

• Determines purposes and means of Personal Data processing
• Is responsible for compliance with Data Protection Laws
• Issues documented instructions to Processor
• Ensures lawful basis for processing exists

2.2 Processor Role#

Processor:

• Processes Personal Data only on documented Controller instructions
• Complies with this DPA and Data Protection Laws
• Implements appropriate technical and organizational measures
• Assists Controller in meeting Data Protection Law obligations

2.3 Scope of Processing#

Processing Activities:

• Hosting and storing campaign execution data
• Providing CognitivaOS platform functionality
• Facilitating communication and workflow management
• Providing contract templates and e-signature, and keeping records of contracts that Controller signs with creators on the platform (Processor is not a party to those contracts)
• Screening creators' posted deliverables for advertising disclosure
• Instructing licensed payment providers to block and release funds for jobs booked by Controller
• Generating reports and analytics
• Providing customer support

NOT Included:

• Anonymization and commercialization of data (Controller role per separate agreement)
• Intelligence Platform AI services (separate processor arrangement if applicable)
• Creator identity, business-entity and sanctions verification and tax handling, which Cognitiva carries out as controller (see Privacy Policy Section 4.1)

3.CONTROLLER INSTRUCTIONS#

3.1 Documented Instructions#

Processor shall process Personal Data only:

1. As documented in this DPA
2. As necessary to provide Services per Services Agreement
3. As set forth in Annex A (Processing Details)
4. As instructed by Controller in writing (email acceptable)

3.2 Unlawful Instructions#

If Processor believes an instruction violates Data Protection Laws:

1. Processor will promptly inform Controller
2. Processor may refuse to comply with instruction
3. Parties will discuss lawful alternative approach
4. Controller may not hold Processor liable for non-compliance with unlawful instruction

3.3 Additional Instructions#

Controller may issue additional written instructions:

• Via email to dpa@cognitiva.systems
• Instructions must be specific and documented
• Processor will confirm receipt within 48 hours
• Processor may charge reasonable fees for materially increased processing scope

4.CONFIDENTIALITY#

4.1 Personnel Obligations#

Processor ensures that personnel authorized to process Personal Data:

• Are bound by confidentiality obligations (contractual or statutory)
• Receive appropriate data protection training
• Access Personal Data only as needed for their role
• Understand consequences of unauthorized disclosure

4.2 Confidentiality Survival#

Confidentiality obligations survive termination of this DPA indefinitely.

5.SECURITY MEASURES#

5.1 Technical and Organizational Measures#

Processor implements appropriate technical and organizational measures to ensure security level appropriate to risk, including:

Access Control:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• Least privilege principle
• Regular access reviews
• Automated session termination

Encryption:

• Data in transit: TLS 1.3 or higher
• Data at rest: AES-256 encryption
• Database encryption
• Encrypted backups

Network Security:

• Firewall protection
• Intrusion detection systems (IDS)
• DDoS mitigation
• Virtual Private Cloud (VPC) isolation
• Network segmentation

Application Security:

• Secure development lifecycle
• Code review and testing
• Regular vulnerability scanning
• Annual penetration testing
• Bug bounty program

Physical Security:

• Data centers with 24/7 monitoring
• Biometric access controls
• Video surveillance
• Environmental controls
• Redundant power and cooling

Organizational:

• Background checks for security-sensitive roles
• Security awareness training
• Incident response procedures
• Business continuity planning
• Disaster recovery testing

5.2 Security Documentation#

Detailed security measures are documented in Annex B.

Controller may request:

• Security questionnaire completion
• SOC 2 Type II report (if available)
• ISO 27001 certificate (if available)
• Security audit results (subject to confidentiality)

5.3 Security Updates#

Processor may update security measures:

• To address evolving threats
• To adopt improved technologies
• To meet regulatory requirements

Notification: Material security changes will be communicated to Controller.

6.SUB-PROCESSORS#

6.1 General Authorization#

Controller grants general authorization for Processor to engage Sub-processors, subject to:

1. Compliance with this Section 6
2. Current Sub-processor list (Annex C)
3. Notification and objection rights

6.2 Sub-processor Obligations#

Processor ensures Sub-processors:

• Are bound by written contract imposing substantially same obligations as this DPA
• Implement appropriate technical and organizational measures
• Comply with applicable Data Protection Laws
• Allow audits and inspections

Processor Liability:
Processor remains fully liable to Controller for Sub-processor performance.

6.3 Sub-processor List#

Current Sub-processors: See Annex C

Categories:

• Cloud and web hosting providers (AWS, Google Cloud, Vercel, Supabase)
• Licensed payment partners
• Transactional email provider (Resend)
• Website analytics and chat assistant providers (Google Analytics, Anthropic)
• Regulated identity-verification provider

6.4 New Sub-processors#

Notification:

• At least 30 days written notice before engaging new Sub-processor
• Notice includes: name, location, processing activities

Objection:

• Controller may object within 15 days of notice on reasonable data protection grounds
• Parties will discuss in good faith
• If unresolved, Controller may terminate Services Agreement with 30 days notice

No Objection:
Failure to object within 15 days constitutes acceptance.

7.DATA SUBJECT RIGHTS#

7.1 Assistance Obligation#

Processor will assist Controller in responding to Data Subject requests to exercise:

• Right of access (GDPR Article 15)
• Right to rectification (GDPR Article 16)
• Right to erasure (GDPR Article 17)
• Right to restriction (GDPR Article 18)
• Right to data portability (GDPR Article 20)
• Right to object (GDPR Article 21)
• Rights related to automated decision-making (GDPR Article 22)
• Equivalent rights under other Data Protection Laws

7.2 Assistance Process#

Controller Requests:

• Controller contacts Processor at dpa@cognitiva.systems
• Specifies Data Subject identity and right being exercised
• Provides necessary information for Processor to locate data

Processor Response:

• Acknowledges request within 48 hours
• Provides requested information/assistance within 10 business days
• Uses reasonable efforts to facilitate Controller's response to Data Subject

Fees:

• No fee for assistance with reasonable number of requests
• Processor may charge reasonable fees for excessive or complex requests

7.3 Direct Requests#

If Processor receives Data Subject request directly:

1. Processor will redirect Data Subject to Controller (unless prohibited by law)
2. Processor will notify Controller promptly
3. Processor will not respond without Controller instruction (except as required by law)

8.PERSONAL DATA BREACH#

8.1 Notification Obligation#

Personal Data Breach: Any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

Processor Obligation:

• Notify Controller without undue delay, and in any event within 48 hours of becoming aware of Personal Data Breach
• Notification to: [Controller designated email in Annex A]

8.2 Breach Notification Content#

Notification shall include (to extent available):

1. Nature of breach and categories/approximate number of affected Data Subjects
2. Likely consequences of breach
3. Measures taken or proposed to address breach
4. Contact point for more information
5. Timeline of breach detection and response

8.3 Investigation and Remediation#

Processor will:

• Investigate breach promptly and thoroughly
• Take reasonable steps to mitigate harm
• Provide updates to Controller as investigation progresses
• Cooperate with Controller's breach response
• Implement measures to prevent recurrence

Documentation:
Processor will document all Personal Data Breaches, even if not notifiable.

8.4 Controller Responsibilities#

Controller is responsible for:

• Determining whether to notify Supervisory Authority (GDPR Article 33)
• Determining whether to notify affected Data Subjects (GDPR Article 34)
• Complying with applicable breach notification laws

Processor will reasonably assist Controller with these determinations and notifications.

9.DATA PROTECTION IMPACT ASSESSMENT (DPIA)#

9.1 Assistance Obligation#

Where Data Protection Laws require Controller to conduct DPIA, Processor will provide reasonable assistance, including:

• Information about processing activities
• Technical and organizational measures
• Security controls and safeguards
• Sub-processor information
• Data flow diagrams

9.2 Prior Consultation#

If DPIA indicates high risk and Controller must consult Supervisory Authority, Processor will provide reasonable assistance with consultation.

9.3 Fees#

No separate fee for reasonable DPIA assistance. Excessive requests may incur fees.

10.AUDITS AND INSPECTIONS#

10.1 Audit Rights#

Controller (or independent third-party auditor) may:

• Audit Processor's compliance with this DPA
• Inspect Processor's processing facilities
• Review Processor's security measures
• Interview Processor personnel (with consent)

Frequency: Once per year, or more frequently if required by Data Protection Laws or if reasonable cause exists.

10.2 Audit Process#

Notice:

• Controller provides at least 30 days advance written notice
• Specifies scope, proposed dates, auditor identity

Coordination:

• Parties mutually agree on audit date and logistics
• Audit during normal business hours
• Processor may require confidentiality agreement from auditor

Scope Limitations:

• Audits limited to Processor's processing of Controller's Personal Data
• No access to other clients' data
• No access to Processor's proprietary information unrelated to DPA compliance
• No disruption to Processor's operations or other clients

10.3 Audit Reports#

Alternative to Audit: Processor may satisfy audit requirement by providing:

• SOC 2 Type II report
• ISO 27001 certificate
• Third-party security audit report

If reports adequately demonstrate compliance, on-site audit may not be necessary.

10.4 Costs#

Controller Costs:

• Controller bears own costs of audit
• Controller bears auditor fees

Processor Costs:

• Processor bears cost of reasonable cooperation
• Processor may charge for excessive or disruptive audits

10.5 Remediation#

If audit reveals non-compliance:

• Processor will implement corrective measures within reasonable timeframe
• Processor will provide status updates
• Follow-up audit at no cost if material non-compliance found

11.INTERNATIONAL DATA TRANSFERS#

11.1 Transfer Locations#

Processor may transfer Personal Data to:

• United States (Processor location)
• Countries where Sub-processors are located (see Annex C)

11.2 Transfer Mechanisms#

For Transfers from EEA/UK to Third Countries:

Processor implements appropriate safeguards:

1. Standard Contractual Clauses (SCCs):

   • EU SCCs (Commission Decision 2021/914) - Annex D
   • UK IDTA (if applicable) - Annex E

2. Supplementary Measures:

   • Encryption in transit (TLS 1.3) and at rest (AES-256)
   • Pseudonymization where feasible
   • Access controls and logging
   • Transfer impact assessments (TIAs)
   • Contractual commitments to resist overbroad government demands

3. EU-U.S. Data Privacy Framework:

   • If Processor is certified, certification as additional safeguard
   • Current status: not certified. Transfers rely on the Standard Contractual Clauses above.

11.3 Adequacy Decisions#

If EU Commission or UK adopts adequacy decision for a transfer destination:

• Transfers may rely on adequacy decision
• SCCs remain in place as fallback

11.4 Transfer Impact Assessments (TIA)#

Processor has conducted TIAs for transfers to:

• United States
• [Other third countries as applicable]

TIA Conclusions:

• Encryption prevents government access to plaintext Personal Data
• Limited personal data in transferred datasets
• Supplementary measures adequate to ensure GDPR-level protection

TIA Updates:

• Reviewed annually
• Reviewed when legislation changes
• Reviewed when new transfer destinations added

11.5 Government Access Requests#

Processor Commitments:

If Processor receives government access request for Controller's Personal Data:

1. Notify Controller:

   • Promptly (unless legally prohibited)
   • Before complying (unless legally prohibited)
   • Provide copy of request (unless legally prohibited)

2. Challenge Overbroad Requests:

   • Seek legal advice
   • Invoke applicable legal protections
   • Request governmental authority to narrow scope

3. Minimize Disclosure:

   • Disclose only minimum data legally required
   • Resist blanket or disproportionate demands

Transparency Reporting:

• Annual transparency report on government requests
• Aggregated statistics (number, type, outcome)

12.DATA RETURN AND DELETION#

12.1 Return Option#

Upon termination or expiry of Services Agreement, Controller may request:

Data Return:

• Format: JSON, CSV, or other machine-readable format
• Method: Secure download link or encrypted transfer
• Timeframe: Within 30 days of request
• Cost: No additional fee

Certified Deletion:

• Deletion of all Personal Data
• Written certification of deletion
• Timeframe: Within 90 days of termination
• Cost: No additional fee

12.2 Deletion Process#

Processor will delete Personal Data by:

• Securely overwriting data
• Cryptographic erasure (destroying encryption keys)
• Physical destruction of media (when retired)

Backup Deletion:

• Backups containing Personal Data deleted within 30 days
• Automatic backup overwrite cycle

12.3 Exceptions to Deletion#

Processor may retain Personal Data to extent:

• Required by applicable law (e.g., tax, audit, financial records)
• Necessary for establishment, exercise, or defense of legal claims
• Stored in backup systems (deleted within 30 days)

Retained Data:

• Isolated and access-restricted
• Not used for processing purposes
• Deleted when legal requirement expires

12.4 Anonymized Data#

Data that has been irreversibly anonymized (per Privacy Policy Section 8) is not Personal Data and is not subject to deletion obligations.

13.PROCESSOR'S WARRANTIES#

13.1 Compliance Warranty#

Processor warrants that:

• Processing will comply with this DPA
• Processing will comply with Data Protection Laws
• Personnel are properly trained on data protection
• Technical and organizational measures are implemented as described
• Sub-processors are contractually bound

13.2 No Other Warranties#

Except as expressly stated in Section 13.1:

Processor makes no other warranties regarding:

• Fitness for particular purpose of Personal Data
• Accuracy or completeness of Personal Data (Controller's responsibility)
• Results achievable using Services

14.LIABILITY AND INDEMNIFICATION#

14.1 Liability Under GDPR#

Controller Liability to Data Subjects:

• GDPR Article 82(2): Controller liable for damage caused by processing that violates GDPR and is attributable to Controller

Processor Liability to Data Subjects:

• GDPR Article 82(2): Processor liable for damage caused by processing that violates GDPR and is attributable to Processor

Joint Liability:

• Where both responsible, Controller and Processor are jointly and severally liable
• Party that paid compensation may claim back from other party the portion attributable to that party

14.2 Liability Between Parties#

Processor Liability to Controller:

Processor is liable to Controller for damage caused by:

• Breach of this DPA
• Processing outside or contrary to Controller's lawful instructions
• Failure to implement appropriate technical and organizational measures

Liability Cap:

Processor's liability under this DPA is limited to the greater of:

• Fees paid by Controller in 12 months prior to claim, OR
• $100,000 USD

Exceptions:

• Liability cap does NOT apply to:
  • Processor's gross negligence or willful misconduct
  • Breach of confidentiality
  • Violation of Data Protection Laws where no cap permitted by law

14.3 Indemnification#

Processor Indemnification:

Processor indemnifies Controller against:

• Fines imposed by Supervisory Authority for Processor's violation of Data Protection Laws
• Claims by Data Subjects for damage caused by Processor's violation
• Legal costs incurred defending against such claims

Conditions:

• Controller provides prompt notice
• Processor has control of defense
• Controller provides reasonable cooperation

Exclusions:

• No indemnity if breach caused by Controller's instructions or actions

15.TERM AND TERMINATION#

15.1 Term#

This DPA:

• Begins: On effective date of Services Agreement
• Continues: For duration of Services Agreement and any renewal
• Survives: For duration of Personal Data retention

15.2 Termination#

This DPA terminates:

• Upon termination of Services Agreement
• 90 days after final deletion of all Personal Data (whichever is later)

Early Termination:

Controller may terminate this DPA immediately if:

• Processor materially breaches DPA
• Supervisory Authority orders cessation of processing
• Transfer safeguards become invalid and no alternative exists

15.3 Effect of Termination#

Upon termination:

• Processor ceases all processing (except retention per Section 12.3)
• Processor returns or deletes Personal Data per Controller instruction
• Obligations in Sections 4 (Confidentiality), 12 (Data Return), 14 (Liability) survive

16.GENERAL PROVISIONS#

16.1 Relationship to Services Agreement#

Precedence: In case of conflict between this DPA and Services Agreement:

• This DPA prevails on data protection matters
• Services Agreement prevails on other matters

Incorporation: This DPA is incorporated into and forms part of Services Agreement.

16.2 Amendments#

DPA Amendments:

This DPA may be amended:

1. By written agreement of both parties
2. By Processor to reflect changes in Data Protection Laws (with 30 days notice)

SCC Amendments:

If EU Commission or UK government updates Standard Contractual Clauses:

• Updated SCCs automatically apply
• Parties will execute updated SCCs within 60 days

16.3 Severability#

If any provision is held invalid or unenforceable:

• Provision modified to minimum extent to make valid
• Remaining provisions remain in full force

16.4 Governing Law#

This DPA is governed by same law as Services Agreement, except:

• SCCs governed by law specified in SCCs
• Where Data Protection Laws impose specific requirements

16.5 Dispute Resolution#

Disputes regarding this DPA resolved per Services Agreement dispute resolution provisions, except:

• Data Subjects may enforce rights directly per Data Protection Laws
• Supervisory Authorities have jurisdiction per Data Protection Laws

16.6 Notices#

To Controller: [Email in Annex A]

To Processor:
Cognitiva Systems Inc.
dpa@cognitiva.systems

Notices effective upon email receipt confirmation.

17.SCHEDULES AND ANNEXES#

This DPA includes the following annexes:

• Annex A: Processing Details
• Annex B: Technical and Organizational Measures
• Annex C: Sub-processor List
• Annex D: EU Standard Contractual Clauses (if applicable)
• Annex E: UK International Data Transfer Addendum (if applicable)

EXECUTION#

CONTROLLER:

By: ___________________________
Name: [Print Name]
Title: [Title]
Date: [Date]

PROCESSOR:

Cognitiva Systems Inc.

By: ___________________________
Name: [Authorized Signatory]
Title: [Title]
Date: [Date]

ANNEX A: PROCESSING DETAILS#

1.Subject Matter of Processing#

Provision of CognitivaOS platform for influencer/creator campaign management.

2.Duration of Processing#

Duration of Services Agreement plus data retention period (up to 90 days post-termination).

3.Nature and Purpose of Processing#

• Hosting and storing campaign execution data
• Facilitating workflow management and approvals
• Enabling communication between campaign participants
• Generating analytics and reports
• Providing customer support
• Contract templates, e-signature and records of contracts between Controller and creators
• Disclosure screening of creators' posted deliverables
• Payment automation: funds blocked on booking and released on approval (via our licensed payment partners)

4.Type of Personal Data#

Campaign Participants:

• Names
• Email addresses
• Phone numbers (optional)
• Social media handles
• Profile information
• Communication content
• Deliverable submissions
• Signed contracts and e-signature records
• Payout status (amounts, dates, release status)

Client Users:

• Business contact details
• Account credentials (hashed)
• Usage data
• IP addresses

5.Categories of Data Subjects#

• Client employees/contractors using platform
• Influencers/creators participating in campaigns
• Brand representatives
• Campaign approvers

6.Obligations and Rights of Controller#

Controller Contact:

• Name: [Insert Contact Name]
• Email: [Insert Email]
• Role: [Insert Role]

Controller Responsibilities:

• Ensure lawful basis for processing
• Provide privacy notices to Data Subjects
• Respond to Data Subject requests (with Processor assistance)
• Determine data retention periods
• Issue processing instructions to Processor

ANNEX B: TECHNICAL AND ORGANIZATIONAL MEASURES#

1.Access Control#

Physical Access:

• Data centers with 24/7 security
• Biometric access controls
• Video surveillance
• Visitor logging

System Access:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• Unique user credentials
• Automatic session timeout (30 minutes)
• Access logging and monitoring

Data Access:

• Least privilege principle
• Need-to-know basis
• Segregation of duties
• Regular access reviews (quarterly)

2.Transmission Control#

Encryption in Transit:

• TLS 1.3 for all data transmission
• Certificate pinning for mobile apps
• VPN for administrative access
• Encrypted backup transfers

Network Security:

• Firewall protection
• Intrusion detection/prevention systems
• DDoS mitigation
• Network segmentation

3.Input Control#

Data Entry:

• User activity logging
• Change tracking for sensitive operations
• Approval workflows for critical changes

Data Quality:

• Input validation
• Format checks
• Duplicate detection

4.Availability Control#

Backup and Recovery:

• Daily automated backups
• Geographic redundancy
• 30-day backup retention
• Quarterly recovery testing

Business Continuity:

• Disaster recovery plan
• Failover systems
• 99.5% uptime target
• Incident response procedures

5.Separation Control#

Data Isolation:

• Multi-tenant architecture with logical separation
• Workspace-based data isolation
• Client data not commingled
• Separate encryption keys per tenant

6.Pseudonymization#

• User IDs tokenized
• IP addresses hashed in logs
• Optional field-level encryption

7.Encryption#

At Rest:

• AES-256 encryption
• Encrypted databases
• Encrypted file storage
• Encrypted backups

Key Management:

• Hardware Security Modules (HSM)
• Key rotation (annually)
• Separate keys per tenant
• Secure key destruction

8.Incident Response#

Detection:

• 24/7 security monitoring
• Automated anomaly detection
• Log analysis (SIEM)

Response:

• Incident response team
• Documented procedures
• Escalation protocol
• Post-incident review

9.Personnel#

Training:

• Data protection training (annually)
• Security awareness training (quarterly)
• Phishing simulations
• Incident response drills

Obligations:

• Confidentiality agreements
• Background checks (security-sensitive roles)
• Clear desk policy
• Acceptable use policy

10.Testing and Evaluation#

Security Testing:

• Vulnerability scanning (monthly)
• Penetration testing (annually)
• Code security reviews
• Dependency vulnerability monitoring

Compliance:

• Internal audits (semi-annually)
• External audits (annually)
• SOC 2 Type II (if available)
• ISO 27001 certification (if available)

ANNEX C: SUB-PROCESSOR LIST#

Last Updated: 8 October 2026

Current Sub-Processors#

Sub-Processor Safeguards#

Each Sub-processor:

• Is contractually bound to GDPR-equivalent obligations
• Implements appropriate technical and organizational measures
• Undergoes security assessment before engagement
• Is subject to ongoing monitoring and audits

Standard Contractual Clauses#

For Sub-processors in third countries without adequacy decision:

• EU SCCs executed (Module 2: Controller-to-Processor or Module 3: Processor-to-Processor)
• UK IDTA executed (if UK data processed)

Updates#

Controller will be notified of Sub-processor changes per Section 6.4 of main DPA.

Notification Email: [Controller email from Annex A]

ANNEX D: EU STANDARD CONTRACTUAL CLAUSES#

The EU Standard Contractual Clauses (Controller to Processor, Module 2) as set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated by reference and form part of this DPA. A signed copy is available upon request at dpa@cognitiva.systems.

Module Used: Module 2 (Controller to Processor)

Docking Clause: Not applicable

Optional Clauses: Clause 7 (Docking clause) not selected; Clause 11 (Redress) optional language not selected

ANNEX E: UK INTERNATIONAL DATA TRANSFER ADDENDUM#

The UK International Data Transfer Addendum (IDTA) to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner's Office and laid before Parliament on 2 February 2022, is incorporated by reference and forms part of this DPA. A signed copy is available upon request at dpa@cognitiva.systems.

Version: B1.0 (February 2022)

Tables:

• Table 1: Parties
• Table 2: Selected SCCs, Modules and Selected Clauses
• Table 3: Appendix Information
• Table 4: Ending this Addendum

END OF DATA PROCESSING AGREEMENT

Version: 3.0
Last Updated: 8 October 2026