Data Processing Addendum

1. Definitions & Scope

1.1. Applicability: This DPA applies strictly to "Business Customers" or "Partners" who use our services to process personal data of third parties (e.g., a company using our API to process their own users' data). It does not apply to individual consumers using our apps for personal use.

1.2. Roles: For the purposes of the UK GDPR and EU GDPR:

• Customer is the Data Controller.

• Provider (Ardcast Services Limited) is the Data Processor.

2. Data Processing Terms

2.1. Instructions: We shall process Personal Data only on documented instructions from you (the Customer), unless required to do so by UK or EU law.

2.2. Confidentiality: We ensure that persons authorized to process the Personal Data (our staff and contractors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.3. Return or Deletion: Upon termination of the Service, we shall, at the choice of the Customer, return or delete all Personal Data, unless applicable law requires storage of the Personal Data.

3. Sub-processors

3.1. General Authorization: You generally authorize us to engage third-party Sub-processors to provide the Services (e.g., AWS, Cloudflare, Stripe). We maintain a list of these Sub-processors which is available upon request.

3.2. Liability: We remain fully liable to you for the performance of our Sub-processors' data protection obligations.

3.3. Changes: We will inform you of any intended changes concerning the addition or replacement of Sub-processors, thereby giving you the opportunity to object to such changes.

4. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest where applicable.

• Access Control: Strict role-based access control (RBAC) and Multi-Factor Authentication (MFA) for our administrative systems.

• Redundancy: Regular backups and disaster recovery protocols to ensure the availability and resilience of processing systems.

• Testing: A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures.

5. Data Breaches

In the event of a Personal Data Breach affecting your data, we shall notify you without undue delay (and in any event within 48 hours) after becoming aware of the breach. Such notification shall describe the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

6. Audits & Inspections

To demonstrate compliance with this DPA, we shall make available all necessary information to the Customer.

6.1. Remote Audits: Given the nature of our digital infrastructure (Cloud-based), physical inspections of premises are generally not technically feasible or relevant. Therefore, audits shall be conducted via:

• Review of our third-party security certifications (e.g., SOC2 reports of our underlying infrastructure).

• Written security questionnaires submitted to our Data Protection Officer.

6.2. Limitations: Any audit must be conducted during regular business hours, with reasonable advance notice, and subject to strict confidentiality undertakings.

7. Annex A: Details of Processing

Subject Matter

The processing of data required to provide API responses, SaaS tools, and digital utility functions to the Customer.

Nature & Purpose

Storage, retrieval, computation, and transmission of data as initiated by the Customer's use of the Services.

Categories of Data Subjects

The Customer's end-users, employees, or clients.

Types of Personal Data

Depending on the tool used, this may include: Names, Email Addresses, IP Addresses, Financial Input Data, or User-Generated Content.

8. Contact for Data Protection

Inquiries regarding this DPA should be directed to:

Data Protection Officer Ardcast Services Limited legal@ardcast.com