LEGAL

Data Processing Addendum

DATA PROCESSING AGREEMENT (DPA)

Between:

Effective Date: 15 April 2026
Agreement Term: Duration of Services Agreement

RECITALS

WHEREAS:

A. Controller has entered into an agreement with Processor for the provision of CognitivaOS platform services ("Services Agreement");

B. In providing Services, Processor will process Personal Data on behalf of Controller;

C. The parties wish to ensure such processing complies with applicable Data Protection Laws;

D. This Data Processing Agreement ("DPA") governs Processor's obligations regarding Personal Data processing.

NOW THEREFORE, the parties agree as follows:

1. DEFINITIONS AND INTERPRETATION

1.1 Definitions

"Data Protection Laws" means all applicable laws relating to the processing of Personal Data, including:

"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws.

"Processing" has the meaning given in applicable Data Protection Laws.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Sub-processor" means any third party appointed by Processor to process Personal Data on Controller's behalf.

"Standard Contractual Clauses" (SCCs) means:

"Supervisory Authority" means the relevant data protection regulatory authority.

1.2 Interpretation

2. SCOPE AND ROLES

2.1 Controller Role

Controller:

2.2 Processor Role

Processor:

2.3 Scope of Processing

Processing Activities:

NOT Included:

3. CONTROLLER INSTRUCTIONS

3.1 Documented Instructions

Processor shall process Personal Data only:

  1. As documented in this DPA
  2. As necessary to provide Services per Services Agreement
  3. As set forth in Annex A (Processing Details)
  4. As instructed by Controller in writing (email acceptable)

3.2 Unlawful Instructions

If Processor believes an instruction violates Data Protection Laws:

  1. Processor will promptly inform Controller
  2. Processor may refuse to comply with instruction
  3. Parties will discuss lawful alternative approach
  4. Controller may not hold Processor liable for non-compliance with unlawful instruction

3.3 Additional Instructions

Controller may issue additional written instructions:

4. CONFIDENTIALITY

4.1 Personnel Obligations

Processor ensures that personnel authorized to process Personal Data:

4.2 Confidentiality Survival

Confidentiality obligations survive termination of this DPA indefinitely.

5. SECURITY MEASURES

5.1 Technical and Organizational Measures

Processor implements appropriate technical and organizational measures to ensure security level appropriate to risk, including:

Access Control:

Encryption:

Network Security:

Application Security:

Physical Security:

Organizational:

5.2 Security Documentation

Detailed security measures are documented in Annex B.

Controller may request:

5.3 Security Updates

Processor may update security measures:

Notification: Material security changes will be communicated to Controller.

6. SUB-PROCESSORS

6.1 General Authorization

Controller grants general authorization for Processor to engage Sub-processors, subject to:

  1. Compliance with this Section 6
  2. Current Sub-processor list (Annex C)
  3. Notification and objection rights

6.2 Sub-processor Obligations

Processor ensures Sub-processors:

Processor Liability:
Processor remains fully liable to Controller for Sub-processor performance.

6.3 Sub-processor List

Current Sub-processors: See Annex C

Categories:

6.4 New Sub-processors

Notification:

Objection:

No Objection:
Failure to object within 15 days constitutes acceptance.

7. DATA SUBJECT RIGHTS

7.1 Assistance Obligation

Processor will assist Controller in responding to Data Subject requests to exercise:

7.2 Assistance Process

Controller Requests:

Processor Response:

Fees:

7.3 Direct Requests

If Processor receives Data Subject request directly:

  1. Processor will redirect Data Subject to Controller (unless prohibited by law)
  2. Processor will notify Controller promptly
  3. Processor will not respond without Controller instruction (except as required by law)

8. PERSONAL DATA BREACH

8.1 Notification Obligation

Personal Data Breach: Any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

Processor Obligation:

8.2 Breach Notification Content

Notification shall include (to extent available):

  1. Nature of breach and categories/approximate number of affected Data Subjects
  2. Likely consequences of breach
  3. Measures taken or proposed to address breach
  4. Contact point for more information
  5. Timeline of breach detection and response

8.3 Investigation and Remediation

Processor will:

Documentation:
Processor will document all Personal Data Breaches, even if not notifiable.

8.4 Controller Responsibilities

Controller is responsible for:

Processor will reasonably assist Controller with these determinations and notifications.

9. DATA PROTECTION IMPACT ASSESSMENT (DPIA)

9.1 Assistance Obligation

Where Data Protection Laws require Controller to conduct DPIA, Processor will provide reasonable assistance, including:

9.2 Prior Consultation

If DPIA indicates high risk and Controller must consult Supervisory Authority, Processor will provide reasonable assistance with consultation.

9.3 Fees

No separate fee for reasonable DPIA assistance. Excessive requests may incur fees.

10. AUDITS AND INSPECTIONS

10.1 Audit Rights

Controller (or independent third-party auditor) may:

Frequency: Once per year, or more frequently if required by Data Protection Laws or if reasonable cause exists.

10.2 Audit Process

Notice:

Coordination:

Scope Limitations:

10.3 Audit Reports

Alternative to Audit: Processor may satisfy audit requirement by providing:

If reports adequately demonstrate compliance, on-site audit may not be necessary.

10.4 Costs

Controller Costs:

Processor Costs:

10.5 Remediation

If audit reveals non-compliance:

11. INTERNATIONAL DATA TRANSFERS

11.1 Transfer Locations

Processor may transfer Personal Data to:

11.2 Transfer Mechanisms

For Transfers from EEA/UK to Third Countries:

Processor implements appropriate safeguards:

  1. Standard Contractual Clauses (SCCs):

    • EU SCCs (Commission Decision 2021/914) - Annex D
    • UK IDTA (if applicable) - Annex E

  2. Supplementary Measures:

    • Encryption in transit (TLS 1.3) and at rest (AES-256)
    • Pseudonymization where feasible
    • Access controls and logging
    • Transfer impact assessments (TIAs)
    • Contractual commitments to resist overbroad government demands

  3. EU-U.S. Data Privacy Framework:

    • If Processor is certified, certification as additional safeguard
    • Current status: [INDICATE IF CERTIFIED]

11.3 Adequacy Decisions

If EU Commission or UK adopts adequacy decision for a transfer destination:

11.4 Transfer Impact Assessments (TIA)

Processor has conducted TIAs for transfers to:

TIA Conclusions:

TIA Updates:

11.5 Government Access Requests

Processor Commitments:

If Processor receives government access request for Controller's Personal Data:

  1. Notify Controller:

    • Promptly (unless legally prohibited)
    • Before complying (unless legally prohibited)
    • Provide copy of request (unless legally prohibited)

  2. Challenge Overbroad Requests:

    • Seek legal advice
    • Invoke applicable legal protections
    • Request governmental authority to narrow scope

  3. Minimize Disclosure:

    • Disclose only minimum data legally required
    • Resist blanket or disproportionate demands

Transparency Reporting:

12. DATA RETURN AND DELETION

12.1 Return Option

Upon termination or expiry of Services Agreement, Controller may request:

Data Return:

Certified Deletion:

12.2 Deletion Process

Processor will delete Personal Data by:

Backup Deletion:

12.3 Exceptions to Deletion

Processor may retain Personal Data to extent:

Retained Data:

12.4 Anonymized Data

Data that has been irreversibly anonymized (per Privacy Policy Section 8) is not Personal Data and is not subject to deletion obligations.

13. PROCESSOR'S WARRANTIES

13.1 Compliance Warranty

Processor warrants that:

13.2 No Other Warranties

Except as expressly stated in Section 13.1:

Processor makes no other warranties regarding:

14. LIABILITY AND INDEMNIFICATION

14.1 Liability Under GDPR

Controller Liability to Data Subjects:

Processor Liability to Data Subjects:

Joint Liability:

14.2 Liability Between Parties

Processor Liability to Controller:

Processor is liable to Controller for damage caused by:

Liability Cap:

Processor's liability under this DPA is limited to the greater of:

Exceptions:

14.3 Indemnification

Processor Indemnification:

Processor indemnifies Controller against:

Conditions:

Exclusions:

15. TERM AND TERMINATION

15.1 Term

This DPA:

15.2 Termination

This DPA terminates:

Early Termination:

Controller may terminate this DPA immediately if:

15.3 Effect of Termination

Upon termination:

16. GENERAL PROVISIONS

16.1 Relationship to Services Agreement

Precedence: In case of conflict between this DPA and Services Agreement:

Incorporation: This DPA is incorporated into and forms part of Services Agreement.

16.2 Amendments

DPA Amendments:

This DPA may be amended:

  1. By written agreement of both parties
  2. By Processor to reflect changes in Data Protection Laws (with 30 days notice)

SCC Amendments:

If EU Commission or UK government updates Standard Contractual Clauses:

16.3 Severability

If any provision is held invalid or unenforceable:

16.4 Governing Law

This DPA is governed by same law as Services Agreement, except:

16.5 Dispute Resolution

Disputes regarding this DPA resolved per Services Agreement dispute resolution provisions, except:

16.6 Notices

To Controller: [Email in Annex A]

To Processor:
Cognitiva Systems Inc.
dpa@cognitiva.systems

Notices effective upon email receipt confirmation.

17. SCHEDULES AND ANNEXES

This DPA includes the following annexes:

EXECUTION

CONTROLLER:

By: ___________________________
Name: [Print Name]
Title: [Title]
Date: [Date]

PROCESSOR:

Cognitiva Systems Inc.

By: ___________________________
Name: [Authorized Signatory]
Title: [Title]
Date: [Date]

ANNEX A: PROCESSING DETAILS

1. Subject Matter of Processing

Provision of CognitivaOS platform for influencer/creator campaign management.

2. Duration of Processing

Duration of Services Agreement plus data retention period (up to 90 days post-termination).

3. Nature and Purpose of Processing

4. Type of Personal Data

Campaign Participants:

Client Users:

5. Categories of Data Subjects

6. Obligations and Rights of Controller

Controller Contact:

Controller Responsibilities:

ANNEX B: TECHNICAL AND ORGANIZATIONAL MEASURES

1. Access Control

Physical Access:

System Access:

Data Access:

2. Transmission Control

Encryption in Transit:

Network Security:

3. Input Control

Data Entry:

Data Quality:

4. Availability Control

Backup and Recovery:

Business Continuity:

5. Separation Control

Data Isolation:

6. Pseudonymization

7. Encryption

At Rest:

Key Management:

8. Incident Response

Detection:

Response:

9. Personnel

Training:

Obligations:

10. Testing and Evaluation

Security Testing:

Compliance:

ANNEX C: SUB-PROCESSOR LIST

Last Updated: 15 April 2026

Current Sub-Processors

Sub-ProcessorServiceLocationProcessing Activity
Amazon Web Services (AWS)Cloud InfrastructureUnited States, [Other Regions]Hosting, storage, compute
Google Cloud Platform (GCP)Cloud InfrastructureUnited States, [Other Regions]Hosting, storage, compute
Stripe, Inc.Payment ProcessingUnited StatesPayment coordination (card data held by Stripe)
[Support Tool]Customer Support[Location]Support ticket management
[Security Tool]Security Monitoring[Location]Threat detection, logging

Sub-Processor Safeguards

Each Sub-processor:

Standard Contractual Clauses

For Sub-processors in third countries without adequacy decision:

Updates

Controller will be notified of Sub-processor changes per Section 6.4 of main DPA.

Notification Email: [Controller email from Annex A]

ANNEX D: EU STANDARD CONTRACTUAL CLAUSES

[INSERT EU Standard Contractual Clauses - Commission Implementing Decision 2021/914]

Module Used: Module 2 (Controller to Processor)

Docking Clause: [Specify if applicable]

Optional Clauses: [Specify which optional clauses selected]

ANNEX E: UK INTERNATIONAL DATA TRANSFER ADDENDUM

[INSERT UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses]

Version: [Current IDTA version]

Tables:

END OF DATA PROCESSING AGREEMENT

Version: 2.0
Last Updated: 15 April 2026

Data Processing Addendum | Cognitiva