Data Processing Addendum

Last updated: 5 October 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Customer and Cyncly covering Customer's use of Cyncly's products and services ("Agreement"). It is incorporated into and governed by Cyncly's Terms and Conditions, available at https://www.cyncly.com/terms-and-conditions. By entering into the Agreement, Customer accepts this DPA. Where Customer has executed a separately negotiated and signed data processing agreement with Cyncly, that agreement prevails over this DPA to the extent of any conflict.

1. PROCESSING OF PERSONAL DATA

1.1 Description of Processing: Details of processing activities including categories of data subjects and Personal Data processed are set out in Annex I.B (Description of Processing). This DPA applies to Customer Personal Data and, unless the context requires otherwise, references in this DPA to Personal Data processed by Cyncly are to Customer Personal Data.

1.2 Cyncly's Role: As a Processor, Cyncly will process Customer Personal Data only: (i) in accordance with documented Customer Instructions; or (ii) where required to do so by applicable law, in which case Cyncly will inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

1.3 Compliance with Law: Each party will comply with Data Protection Law applicable to its processing of Personal Data. Customer is responsible for ensuring Customer Instructions comply with Data Protection Law. Cyncly will immediately inform Customer if, in its opinion, an instruction infringes Data Protection Law.

1.4 Confidentiality: Cyncly will ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.

1.5 Customer Responsibilities: Customer represents and warrants that: (i) it has, and will maintain, a lawful basis under Data Protection Law for the processing of Customer Personal Data by Cyncly under this DPA; (ii) it has provided all notices to, and obtained all consents from, Data Subjects that are required under Data Protection Law for that processing; and (iii) its Customer Instructions and its use of Cyncly's products will not cause Cyncly to breach Data Protection Law.

1.6 Cyncly as Independent Controller: This DPA does not apply to Personal Data that Cyncly processes as an independent Controller for its own purposes, including: (i) account, subscription and billing information; (ii) business contact information of Customer's personnel used to manage the commercial relationship; and (iii) product usage, licensing and analytics data used to operate, secure, license, support and improve Cyncly's products (together, "Cyncly Controller Data"). Cyncly processes Cyncly Controller Data in accordance with its Privacy Policy and Data Protection Law.

2. SECURITY AND SECURITY INCIDENTS

2.1 Security Measures: Cyncly has implemented and will maintain appropriate technical and organisational measures to protect the security, confidentiality, integrity, and availability of Personal Data, including but not limited to the baseline measures as described in Annex II (Technical and Organisational Measures).

2.2 Security Incidents: Cyncly will notify Customer without undue delay, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data ("Security Incident"). Cyncly will take reasonable steps to investigate, mitigate, and remediate the Security Incident. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks and other network attacks on firewalls or networked systems.

2.3 Content of Notification: Cyncly's notification will, to the extent then known, describe: (i) the nature of the Security Incident, including where possible the categories and approximate number of Data Subjects and Personal Data records concerned; (ii) the name and contact details of a Cyncly point of contact; (iii) the likely consequences of the Security Incident; and (iv) the measures taken or proposed to address the Security Incident and mitigate its possible adverse effects. Where it is not possible to provide all of this information at the same time, Cyncly may provide it in phases without undue further delay.

2.4 No Admission: Cyncly's notification of, or response to, a Security Incident is not an acknowledgement by Cyncly of any fault or liability in respect of the Security Incident.

3. SUB-PROCESSORS

3.1 General Authorisation: Customer generally authorises Cyncly to engage sub-processors (including Cyncly group companies) to process Personal Data. Cyncly will enter into written agreements with each sub-processor imposing the same data protection obligations as those set out in this DPA, and remains fully liable to Customer where a sub-processor fails to fulfil those obligations.

3.2 Sub-processor List: Annex III sets out Cyncly's current sub-processors, including each sub-processor's function and processing location. Cyncly will update Annex III when it appoints a new sub-processor and publish the updated DPA with a revised "Last updated" date.

(a) EEA, UK and Swiss Customers (where Customer is established in the European Economic Area, the United Kingdom or Switzerland, or processes Personal Data subject to the GDPR, UK GDPR or Swiss FADP):

Cyncly will give Customer at least 10 days' prior written notice before engaging a new sub-processor to process Personal Data, by email to Customer’s primary contact on record or other written means (including in-product or account notices). During that period, Customer may object in writing on reasonable data protection grounds. If Customer does not object within that 10-day period, Customer is deemed to have accepted the new sub-processor. Cyncly and Customer will discuss commercially reasonable alternative solutions in good faith to resolve the objection. If the parties cannot resolve the matter within the period mutually agreed for that purpose (or, absent agreement, within 30 days of Customer's objection), Customer may terminate the affected Services on written notice as its sole remedy with respect to that sub-processor change, provided such termination right shall not relieve Customer of any payment obligations accrued prior to the termination date. Where Cyncly needs to replace a sub-processor urgently for security, legal or service continuity reasons, Cyncly may engage the replacement immediately and will notify Customer as soon as reasonably practicable afterwards. Customer's objection rights under this clause will then apply from the date of that notice.

(b) All Other Customers:

Cyncly will notify Customer of each new sub-processor appointed to process Personal Data by updating Annex III in accordance with clause 3.2. Customer will be deemed to have no objection to an appointed sub-processor unless Customer notifies Cyncly otherwise in writing within 10 days of that update. To the extent applicable law requires Cyncly to provide advance notice of sub-processor changes, Cyncly will do so in accordance with such requirements.

4. DATA SUBJECT RIGHTS AND ASSISTANCE

4.1 Data Subject Requests: Cyncly will provide reasonable and timely assistance to enable Customer to respond to requests from individuals exercising rights under Data Protection Law, to the extent Customer cannot fulfil such requests using the self-service functionality of Cyncly's products.

4.2 DPIAs and Regulatory Consultation: Where required by applicable Data Protection Law, Cyncly will provide reasonable assistance to Customer in connection with any data protection impact assessment or consultation with a regulatory authority required under Data Protection Law.

4.3 Government Requests: If Cyncly receives a legally binding request from a governmental or law enforcement authority for disclosure of Personal Data, Cyncly will: (i) promptly notify Customer unless prohibited by law; (ii) where permitted, refer the requesting party to Customer; (iii) use reasonable efforts to challenge any request that is unlawful, disproportionate, or overbroad; and (iv) not disclose Personal Data unless required by law.

4.4 Costs: To the extent permitted by Data Protection Law, Cyncly may charge Customer, at its then-current professional services rates notified to Customer in advance, for: (i) assistance under clauses 4.1 and 4.2 that goes beyond the self-service functionality of Cyncly's products; and (ii) any audit under clause 6.2, except where the audit reveals a material breach of this DPA by Cyncly.

5. DELETION AND RETURN

On expiry or termination of the Agreement, Cyncly will delete or return Customer Personal Data in accordance with Customer's request. Customer may export Customer Content using the self-service functionality of Cyncly's products, or request its return, at any time before, or within 30 days after, expiry or termination. If Customer has not made a request within that period, Cyncly will delete Customer Personal Data within 90 days after expiry or termination, without being liable to Customer. Customer Personal Data held in backups will be deleted in line with Cyncly's normal backup rotation cycle and, until deleted, will remain protected under this DPA and will not be actively processed. Cyncly may retain Personal Data only to the extent required by applicable law, subject to the confidentiality and processing restrictions in this DPA.

6. AUDIT

6.1 Audit Reports:

(a) EEA, UK and Swiss Customers: Upon Customer's written request at reasonable intervals, and subject to appropriate confidentiality controls, Cyncly will make available all information reasonably necessary to demonstrate compliance with this DPA, including copies of its then-current third-party certifications and audit reports (where held) and responses to Customer's reasonable written security questionnaires (no more than once per year, unless following a Security Incident), to support Customer's verification of compliance with this DPA, in accordance with GDPR/UK GDPR.

(b) All Other Customers: Cyncly will make available its then-current third-party certifications upon reasonable written request, subject to appropriate confidentiality controls.

6.2 On-Site Audit:

(a) EEA, UK and Swiss Customers: Only to the extent Customer's audit requirements under applicable Data Protection Law cannot reasonably be satisfied under Section 6.1(a), Customer (or its appointed representative) may, at Customer's expense, conduct a compliance audit with minimum 45 days advance written notice, once per year, during business hours and subject to reasonable confidentiality controls.

(b) All Other Customers: No on-site audit right applies unless expressly required by applicable Data Protection Law.

6.3 Regulators and SCCs: Nothing in this clause 6 limits: (i) any audit or inspection by a competent supervisory authority; or (ii) any right of Customer under the Standard Contractual Clauses. Where the Standard Contractual Clauses apply, Customer agrees to exercise its audit rights under Clause 8.9 of the Standard Contractual Clauses in the manner set out in this clause 6.

7. INTERNATIONAL TRANSFERS

Cyncly will only transfer Personal Data outside the jurisdiction in which it was received in accordance with applicable Data Protection Law. Where applicable law requires a transfer mechanism, Cyncly will rely on Standard Contractual Clauses or such other mechanism as specified in Schedule 1 (Region-Specific Terms).

Cyncly group companies contract with customers globally on the same terms. Accordingly: (a) where Customer transfers Personal Data subject to the GDPR, UK GDPR or Swiss FADP to a Cyncly entity located in a country that does not benefit from an adequacy decision, the Standard Contractual Clauses (Module 2 or Module 3, as applicable) apply to that transfer as set out in Schedule 1; (b) where the contracting Cyncly entity is located in the EEA, the UK, Switzerland or another adequate country, no transfer mechanism is required for the transfer from Customer to Cyncly, and Cyncly will ensure that any onward transfer to a sub-processor in a country without an adequacy decision is subject to an appropriate safeguard (such as the EU-US Data Privacy Framework, or Standard Contractual Clauses (Module 3) with that sub-processor); and (c) where Customer is located outside the EEA and Cyncly, as Processor in the EEA, transfers Personal Data to Customer, Module 4 (Processor to Controller) of the Standard Contractual Clauses applies to the extent required by the GDPR.

8. ARTIFICIAL INTELLIGENCE

8.1 No Training Use: Cyncly will not use Customer Personal Data to train its AI or machine learning models, or for any other purpose outside the scope of providing the Services, without Customer's express documented instructions. Customer instructs Cyncly to anonymise or aggregate Customer Personal Data so that it no longer constitutes Personal Data, and Cyncly may use the resulting anonymised, aggregated or non-personal data to operate and improve its products and services. Cyncly will require each sub-processor that provides AI functionality to be bound by an equivalent restriction on using Customer Personal Data to train its models.

8.2 No Automated Decisions: Cyncly will not make solely automated decisions about individuals that produce legal or similarly significant effects, using Customer Personal Data, except on Customer's documented instructions.

8.3 Privacy by Design: Cyncly will design AI features within its products to support Customer's compliance with Data Protection Law, including the principles of data protection by design and by default, and will provide reasonable assistance to Customer with any data protection impact assessment relating to those features in accordance with clause 4.2.

9. REGION-SPECIFIC TERMS

Where Cyncly processes Personal Data originating in a region listed in Schedule 1 (Region-Specific Terms), the applicable regional terms will apply, including those governing international transfers. In case of conflict, the order of precedence in clause 10.2 applies.

10. LIABILITY, PRECEDENCE AND CHANGES

10.1 Liability: Each party's liability arising out of or in connection with this DPA (including the Standard Contractual Clauses, to the extent they permit) is subject to the exclusions and limitations of liability in the Agreement. Nothing in this clause limits any party's liability to Data Subjects under the third-party beneficiary provisions of the Standard Contractual Clauses.

10.2 Order of Precedence: If there is any conflict or inconsistency, the following order of precedence applies (highest first): (i) the Standard Contractual Clauses and any other transfer mechanism incorporated under Schedule 1; (ii) Schedule 1 (Region-Specific Terms); (iii) the main body of this DPA and its Annexes; and (iv) the Agreement. This DPA prevails over the Agreement in relation to the processing of Customer Personal Data. This clause is subject to the precedence of any separately signed data processing agreement described in the introduction to this DPA.

10.3 Changes to this DPA: Cyncly may update this DPA from time to time to reflect changes in Data Protection Law, regulatory guidance or its products and services, provided that no update will materially reduce the overall level of protection for Customer Personal Data during Customer's then-current subscription term, unless required by law. Updates take effect from the "Last updated" date shown on the updated DPA.

11. DEFINITIONS

Term	Meaning
"Controller"	The natural or legal person which determines the purposes and means of processing Personal Data. Also referred to as "Business" under applicable Data Protection Law.
"Customer Content"	Data, including Personal Data, that is submitted to or processed within Cyncly's products by Customer or its Authorised Users.
"Customer Instructions"	Customer's documented instructions to Cyncly to process Customer Personal Data, which comprise: (i) the Agreement and this DPA; (ii) Customer's and its Authorised Users' use and configuration of Cyncly's products; and (iii) any other reasonable written instructions agreed by the parties. Customer instructs Cyncly to process Customer Personal Data to: provide, host, maintain and support Cyncly's products and services (including troubleshooting and responding to support requests); back up and restore data and maintain disaster recovery; monitor, secure, and investigate and remediate Security Incidents; engage sub-processors and make transfers in accordance with clause 3 and Schedule 1; anonymise or aggregate Customer Personal Data as described in clause 8.1; delete or return Customer Personal Data in accordance with clause 5; and perform its other obligations under the Agreement.
"Data Protection Law"	Laws and regulations applicable to a party's processing of Personal Data under this DPA, including without limitation the GDPR, UK GDPR, the Swiss FADP, US State Privacy Laws, the LGPD, Canadian Privacy Laws, Australia's Privacy Act 1988, New Zealand's Privacy Act 2020 and Indian Privacy Law, in each case as amended or replaced from time to time and as further described in Schedule 1. References in this DPA to "Privacy Laws" mean Data Protection Law.
"Personal Data"	Information about an identified or identifiable natural person, or that otherwise constitutes "personal information", "personally identifiable information", or similar terms as defined under applicable Data Protection Law.
"Processor"	The entity that processes Personal Data on behalf of the Controller. Also referred to as "Service Provider" under applicable Data Protection Law.
"Standard Contractual Clauses"	The standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914, including Module 2 (Controller to Processor), Module 3 (Processor to Processor) and, where applicable, Module 4 (Processor to Controller), as they may be amended or replaced from time to time, together (where applicable) with the UK Addendum and the Swiss adaptations described in Schedule 1.
"Sub-Processor"	Any processor engaged by Cyncly to process Customer Personal Data on behalf of Customer.
"Authorised Users"	Customer's employees, contractors and other individuals whom Customer authorises to access and use Cyncly's products under the Agreement.
"Canadian Privacy Laws"	The Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Alberta PIPA, British Columbia PIPA and Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).
"Customer Personal Data"	Personal Data contained in Customer Content, and Personal Data generated by Cyncly's products through the use of those products by Customer and its Authorised Users (such as in-product audit and activity records), in each case processed by Cyncly on behalf of Customer. Customer Personal Data does not include Cyncly Controller Data (clause 1.6).
"Data Subject"	The identified or identifiable natural person to whom Personal Data relates.
"GDPR"	Regulation (EU) 2016/679 (the General Data Protection Regulation).
"Indian Privacy Law"	The Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, as and when their provisions come into force.
"LGPD"	Brazil's Lei Geral de Proteção de Dados (Federal Law No. 13,709/2018) and regulations issued by the Autoridade Nacional de Proteção de Dados (ANPD).
"Services"	The products and services provided by Cyncly to Customer under the Agreement.
"Swiss FADP"	The Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances, as amended or replaced.
"UK Addendum"	The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), as amended or replaced.
"UK GDPR"	The GDPR as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the Data (Use and Access) Act 2025).
"US State Privacy Laws"	The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), and all other comprehensive consumer privacy laws of US states that apply to the processing of Customer Personal Data.

SCHEDULE 1 – REGION-SPECIFIC TERMS

Unless otherwise defined in this DPA, capitalised terms in this Schedule have the meanings given to them in applicable Data Protection Law.

1. EUROPEAN ECONOMIC AREA AND SWITZERLAND

1.1 "Data Protection Law" includes the EU General Data Protection Regulation (GDPR) and the EU ePrivacy Directive.

1.2 The EU Standard Contractual Clauses ("EU SCCs") as adopted by Commission Implementing Decision (EU) 2021/914 will apply to transfers of Personal Data from the EEA to any country not recognised as adequate. The EU SCCs are incorporated into this DPA by reference and deemed accepted on entry into the Agreement. Module 2 (Controller to Processor) applies where Customer is a Controller; Module 3 (Processor to Processor) applies where Customer is itself a Processor. Clause 17 is governed by the law of Ireland; Clause 18(b) disputes are resolved before the courts of Ireland. The competent supervisory authority is determined in accordance with Clause 13 of the EU SCCs, as set out in Annex I.C. For the purposes of the EU SCCs: (i) Clause 7 (Docking clause) applies; (ii) for Clause 9(a), Option 2 (general written authorisation) applies and the time period for prior notice of sub-processor changes is as set out in clause 3.3(a) of this DPA; and (iii) the optional wording in Clause 11(a) (independent dispute resolution body) does not apply.

1.3 Annexes I.A, I.B and I.C to the EU SCCs are populated by Annex I.A (List of Parties), Annex I.B (Description of Processing and Transfer) and Annex I.C (Competent Supervisory Authority) of this DPA respectively. Annex II to the EU SCCs is populated by Annex II (Technical and Organisational Measures) of this DPA, and Annex III to the EU SCCs is populated by Annex III (Sub-processors) of this DPA.

1.4 Switzerland. Where the Swiss FADP applies to a transfer of Personal Data, the EU SCCs apply as set out in section 1.2 of this Schedule, with the following adaptations: (i) to the extent the transfer is governed by the Swiss FADP, the FDPIC is the competent supervisory authority and references to the GDPR are to be read as references to the Swiss FADP; (ii) the term "Member State" must not be interpreted so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs; and (iii) "Data Protection Law" includes the Swiss FADP.

2. UNITED KINGDOM

2.1 "Data Protection Law" includes the UK GDPR and the Data Protection Act 2018, each as amended (including by the Data (Use and Access) Act 2025).

2.2 The UK International Data Transfer Addendum to the EU SCCs ("UK Addendum"), version B1.0 issued by the ICO, will apply to transfers of Personal Data from the UK to any country not recognised as adequate under UK law. The UK Addendum is incorporated by reference and deemed accepted on entry into the Agreement. For the purposes of the UK Addendum: Table 1 (Parties) is populated by Annex I.A of this DPA; Table 2 references the EU SCCs as described in Section 1 of this Schedule; Table 3 (Appendix Information) is populated by Annexes I.A, I.B, I.C, II and III of this DPA; and for Table 4, "neither Party" is selected, so neither party may end the UK Addendum when the Approved Addendum changes, as set out in Section 19 of the UK Addendum. The competent supervisory authority is the Information Commissioner's Office.

3. UNITED STATES

3.1 "Data Protection Law" includes applicable US state privacy laws, including the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA") and equivalent state laws.

3.2 Cyncly is a "Service Provider" (CCPA/CPRA) or equivalent "Processor" under applicable US state laws. Cyncly will process Personal Data solely for the business purpose of providing the Services. Cyncly will not: (a) sell or share Personal Data as those terms are defined under applicable US state laws; (b) retain, use, or disclose Personal Data for any purpose other than performing the Services; (c) process Personal Data outside the direct business relationship with Customer; or (d) combine Customer Personal Data with data obtained from other sources except as permitted by applicable law. Cyncly certifies that it understands and will comply with the restrictions in this section 3.2.

3.3 Cyncly will notify Customer if it determines it can no longer meet its obligations under applicable US State Privacy Laws. Customer may take reasonable steps to stop and remediate any unauthorised processing.

3.4 To the extent Cyncly processes Sensitive Personal Information (as defined under CPRA or equivalent term under applicable US state law) on behalf of Customer, Cyncly will comply with all applicable restrictions on the use and disclosure of such information, including any obligation to limit processing to the purposes specified by Customer, and will not use Sensitive Personal Information for any other purpose except as permitted by applicable law.

4. BRAZIL

4.1 "Data Protection Law" includes Lei Geral de Proteção de Dados (LGPD), Federal Law No. 13,709/2018.

4.2 Customer is the Controlador and Cyncly is the Operador. Where required under the LGPD, the standard contractual clauses approved by the ANPD in Resolution CD/ANPD No. 19/2024 ("Brazilian SCCs") will apply to international transfers of Personal Data from Brazil. The Brazilian SCCs are incorporated into this DPA by reference, in full and without amendment, and prevail over this DPA to the extent of any conflict. Cyncly will notify Customer without undue delay and, where feasible, within 48 hours of any security incident affecting Personal Data of Brazilian residents, to enable Customer to fulfil its obligations to the ANPD and affected data subjects under Article 48 LGPD.

5. CANADA

5.1 "Data Protection Law" includes PIPEDA and provincial equivalents (including Alberta PIPA, BC PIPA, and the Quebec Act respecting the protection of personal information in the private sector as amended by Law 25 / Bill 64).

5.2 Cyncly will comply with the applicable obligations under Canadian Privacy Laws in its role as a service provider. Cyncly will notify Customer without undue delay of any breach of security safeguards involving Personal Data where it is reasonable to believe the breach creates a real risk of significant harm to an individual, to enable Customer to comply with its obligations under PIPEDA and the Security Breach of Personal Information Regulations, including reporting to the Office of the Privacy Commissioner. For Personal Data of Quebec residents, Cyncly will provide reasonable assistance to Customer with any privacy impact assessment that Customer is required to conduct before Personal Data is communicated outside Quebec, and will notify Customer of any confidentiality incident in accordance with the Quebec Private Sector Act.

6. AUSTRALIA

6.1 "Data Protection Law" includes the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

6.2 Cyncly will comply with the APPs to the extent applicable to its role as a service provider. Cyncly will notify Customer without undue delay of any data breach likely to result in serious harm to an individual, to enable Customer to comply with its obligations under the Notifiable Data Breaches scheme. Before disclosing Personal Data to overseas recipients, Cyncly will take reasonable steps to ensure they do not breach the APPs.

7. INDIA

7.1 "Data Protection Law" includes the Digital Personal Data Protection Act 2023 ("DPDP Act") and the Digital Personal Data Protection Rules 2025 issued thereunder, in each case as and when their provisions come into force under the phased implementation notified by the Government of India.

7.2 Customer is the Data Fiduciary and Cyncly is the Data Processor. Cyncly will process Personal Data only in accordance with Customer's instructions and applicable Indian Privacy Law. Cyncly will notify Customer of any personal data breach without undue delay, implement reasonable security safeguards, and delete or return Personal Data on termination or instruction. Cyncly will not transfer Personal Data of Indian data principals to any country restricted by the Central Government of India under the DPDP Act.

8. NEW ZEALAND

8.1 "Data Protection Law" includes the Privacy Act 2020 (New Zealand) and the Information Privacy Principles ("IPPs") set out therein.

8.2 Cyncly will comply with the applicable IPPs to the extent applicable to its role as a service provider. Before disclosing Personal Data of New Zealand residents to overseas recipients, Cyncly will take reasonable steps to ensure they protect that information in a manner comparable to the Privacy Act 2020, consistent with IPP 12. Cyncly will notify Customer without undue delay of any privacy breach involving Personal Data of New Zealand residents that has caused, or is likely to cause, serious harm to one or more individuals, to enable Customer to comply with its notification obligations to the Office of the Privacy Commissioner under Part 6 of the Privacy Act 2020.

9. OTHER JURISDICTIONS

9.1 "Data Protection Law" includes any applicable data protection or privacy legislation in force in the jurisdiction in which the relevant Personal Data originates, to the extent applicable to Cyncly's processing as a service provider or processor.

9.2 For jurisdictions not specifically listed in this Schedule, Cyncly will comply with applicable local Data Protection Law and implement reasonable technical and organisational safeguards consistent with the principles set out in the main body of this DPA. Cyncly will notify Customer without undue delay of any personal data breach involving Personal Data of residents of such jurisdictions where notification is required by applicable law.

ANNEX I.A – LIST OF PARTIES

	Data Exporter (Customer)	Data Importer (Cyncly)
Name	As set out in the Agreement.	As set out in the Agreement (doing business as Cyncly and its relevant group entities).
Address	As set out in the Agreement.	As set out in the Agreement.
Contact	As set out in the Agreement.	legal@cyncly.com
Role	Controller (or Processor, where Customer processes on behalf of its own customers)	Processor (or Sub-Processor)
Signature / Date	By accepting the Agreement (including these DPA terms at https://www.cyncly.com/terms-and-conditions), Customer is deemed to have signed and dated this Annex.	Cyncly is deemed to have signed and dated this Annex on the same date.

ANNEX I.B – DESCRIPTION OF PROCESSING AND TRANSFER

Field	Details
Categories of Data Subjects	Authorised Users (Customer's employees, contractors, and personnel who access the products); the Customer's own customers, prospects, and end clients whose details are entered into the product; and other individuals whose Personal Data is included in Customer Content.
Categories of Personal Data	Contact details (names, email addresses, telephone numbers, postal addresses); design content (space/kitchen/bathroom designs and images, which may incidentally include images of individuals or premises); user-generated content (open text, notes, and messages between Authorised Users); usage and activity data generated within the products on behalf of Customer (system-generated audit records such as who accessed or modified an item and when). Cyncly Controller Data (clause 1.6) is outside the scope of this Annex.
Sensitive / Special Category Data	Cyncly does not intend to process special category or sensitive data. Customer must not submit such data through Cyncly's products.
Nature of Processing	Collection, storage, hosting, transmission, display, organisation, access for support and maintenance, backup and recovery, security monitoring, anonymisation and aggregation, and deletion of Personal Data, carried out electronically as configured and used by Customer.
Purpose of Processing	Providing the core functionality of Cyncly's products and services for Customer's permitted purpose, including account access, design creation and sharing, collaboration, quoting, providing support and maintenance, maintaining security and business continuity, providing AI-enabled features as described in clause 8, and order processing.
Duration	For the term of the Agreement (including any renewal), and thereafter in accordance with clause 5 (Deletion and Return) of this DPA.
Frequency	Continuous.
Onward Transfers to Sub-processors	Cyncly transfers Customer Personal Data to sub-processors as set out in clause 3 (Sub-processors) as set out in Annex III.

ANNEX I.C – COMPETENT SUPERVISORY AUTHORITY

Where the EU SCCs apply, the competent supervisory authority is determined in accordance with Clause 13 of the EU SCCs, being: (i) where Customer is established in an EU Member State, the supervisory authority of that Member State; (ii) where Customer is not established in the EU but falls within Article 3(2) of the GDPR and has appointed a representative under Article 27(1) of the GDPR, the supervisory authority of the Member State in which the representative is established; and (iii) where Customer is not established in the EU and is not required to appoint a representative, the supervisory authority of the Member State in which the Data Subjects whose Personal Data is transferred are located. Where the UK Addendum applies, the competent authority is the Information Commissioner's Office. For transfers governed by the Swiss FADP, the competent authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES

The following measures describe Cyncly's current baseline security programme.

1. INTRODUCTION

These Technical and Organizational Measures ("TOMs") describe the baseline security measures designed to support the confidentiality, integrity, availability and resilience of processing systems and services in accordance with applicable data protection laws.

The measures described below represent Cyncly's baseline organizational security programme and are intended to describe security controls generally implemented across Cyncly. Specific products, services, hosting environments and business units may implement additional, alternative or different controls based on architecture, customer requirements, regulatory obligations and operational requirements. Product-specific security measures may be provided separately where appropriate.

2. INFORMATION SECURITY GOVERNANCE

Cyncly maintains an information security programme designed to support the protection of customer information and Personal Data.

Measures include:

Information Security policies and standards.
Defined security governance and oversight responsibilities.
Security awareness and training programmes.
Risk management and assessment activities.
Security incident management processes.
Review of security risks and control effectiveness.
Management reporting and governance activities where appropriate.

3. ACCESS MANAGEMENT

Access to systems and information is restricted to authorized personnel based upon business requirements and the principle of least privilege.

Measures include:

Role-based access controls.
Unique user accounts.
Authentication controls.
Multi-factor authentication required for all administrative and privileged access to production systems, and for remote access to corporate services.
Periodic review of access rights and privileged access.
Joiner, mover, and leaver processes.
Monitoring of privileged activities where appropriate.

4. PERSONNEL SECURITY

Cyncly implements personnel-related measures intended to support the secure handling of information.

Measures include:

Confidentiality obligations.
Security awareness training.
Acceptable use requirements.
Role-based responsibilities.
Access removal following termination or role change.
Background checks, where permitted by law and appropriate to the role.

5. ENDPOINT AND DEVICE SECURITY

Measures are implemented to support the protection of devices used to access company systems and information.

Measures include:

Managed endpoint security controls.
Anti-malware protection.
Endpoint detection and response capabilities, where applicable.
Security patching processes.
Device compliance requirements.
Encryption of devices where supported.
Secure configuration standards.

6. NETWORK SECURITY

Cyncly employs network security measures designed to reduce the risk of unauthorized access.

Measures include:

Firewall technologies and network filtering controls.
Secure remote access mechanisms.
Segmentation between production and non-production environments where appropriate.
Monitoring network activity.
Protection against unauthorized network access.

7. ENCRYPTION AND PROTECTION OF DATA

Measures are implemented to protect information during storage and transmission.

Data in Transit

Measures include:

Encryption of Customer Personal Data in transit over public networks using TLS 1.2 or higher.
Secure administrative and management connections.
Encrypted communication between systems, where appropriate.

Data at Rest

Measures include:

Encryption at rest of production databases and storage containing Customer Personal Data, using industry-standard algorithms (e.g. AES-256).
Encryption of supported backup repositories.
Encryption capabilities provided by underlying cloud or hosting platforms.

8. LOGGING AND MONITORING

Cyncly maintains monitoring capabilities intended to identify and investigate security events.

Measures include:

Collection of security-related logs.
Centralized monitoring where appropriate.
Alerting for suspicious activity.
Monitoring of authentication and access events.
Investigation and escalation procedures.
Retention of logs in accordance with business and legal requirements.

9. VULNERABILITY AND PATCH MANAGEMENT

Measures are maintained to identify and address vulnerabilities affecting relevant systems and services.

Measures include:

Vulnerability identification activities.
Security advisory monitoring.
Patch management processes.
Risk-based prioritization of remediation activities.
Tracking and review of remediation status.

10. APPLICATION SECURITY

Where applicable, security practices are incorporated throughout development and deployment activities.

Measures include:

Secure development practices.
Change and release management controls.
Security testing activities, where appropriate.
Management of software vulnerabilities.
Segregation of development, test and production environments.
Review of changes prior to production deployment where applicable.

11. CHANGE MANAGEMENT

Changes to production systems are managed through controlled processes intended to reduce operational and security risk.

Measures include:

Documented change management practices.
Review and approval of significant changes.
Testing of changes where appropriate.
Emergency change procedures.
Record keeping for relevant changes.

12. AVAILABILITY, RESILIENCE AND RECOVERY

Measures are maintained to support the availability and resilience of systems and services.

Measures include:

Service monitoring capabilities.
Backup and recovery processes.
Business continuity planning activities.
Disaster recovery planning activities.
Recovery procedures for critical services.
Capacity and resilience considerations, where appropriate.

13. SECURITY INCIDENT MANAGEMENT

Cyncly maintains processes designed to identify, assess, respond to and recover from security incidents.

Measures include:

Security event reporting procedures.
Incident classification and prioritization.
Investigation and containment activities.
Escalation procedures.
Corrective and recovery actions.
Post-incident review activities where appropriate.
Customer notification processes where required by law or contract.

14. SUPPLIER AND THIRD-PARTY SECURITY

Security risks associated with third-party providers are managed through governance and review processes.

Measures include:

Security due diligence activities.
Review of supplier security information where appropriate.
Contractual security requirements.
Management of approved subprocessors where applicable.
Ongoing review of material supplier risks.

15. ASSET MANAGEMENT

Cyncly maintains processes intended to support visibility and accountability for relevant information assets.

Measures include:

Maintenance of asset inventories where appropriate.
Identification of asset ownership.
Classification of information assets where appropriate.
Periodic review of asset information.

16. DATA LIFECYCLE MANAGEMENT

Measures are maintained to support the secure retention and disposal of information.

Measures include:

Data retention processes.
Secure deletion and disposal procedures.
Data return or deletion activities where contractually required.
Disposal of storage media in accordance with internal requirements.
Management of archival information where applicable.

17. SEPARATION AND DATA ISOLATION

Measures are implemented to reduce the risk of unauthorised access between environments and datasets.

Measures include:

Logical separation of production and non-production environments.
Access restrictions to customer information.
Segregation of administrative responsibilities where practical.
Logical separation controls within shared environments where applicable.

18. SECURITY TESTING AND ASSURANCE

Cyncly conducts security assurance activities intended to evaluate the effectiveness of security measures.

Measures include:

Security assessments performed on a risk-based basis.
Independent penetration testing of production systems and customer-facing applications at least annually, with findings remediated on a risk-based basis.
Review of remediation activities.
Internal and/or external security reviews, where determined necessary by business requirements.
Ongoing evaluation of security risks and controls.

19. PRIVACY AND DATA PROTECTION

Measures are maintained to support compliance with applicable data protection requirements.

Measures include:

Processing of Personal Data on documented instructions.
Assistance with data subject rights requests where applicable.
Privacy and data protection governance activities.
Support for data retention and deletion obligations.
Personal data breach management processes.
Management of international data transfers where applicable.

ANNEX III – SUB-PROCESSORS

The table below is a snapshot of Cyncly's sub-processors as at the "Last updated" date of this DPA.

Sub-Processor	Service	Location	Primary Product(s)
Cyncly Affiliates - See https://www.cyncly.com/affiliate-list-and-country/	Customer support, product development, hosting operations and related services	As per list	All Products
Microsoft Azure (Microsoft Ireland Operations Ltd, One Microsoft Place, Leopardstown, Dublin 18, D18 P521)	Cloud infrastructure and hosting	UK / EU	All Products
Zendesk (Zendesk International Ltd, 55 Charlemont Place, Dublin 2, D02 F985, Ireland)	Customer support platform	EU	All Products
MongoDB (MongoDB GmbH, Schlüterstrasse 39, 10629 Berlin, Germany)	Database services	Europe	Flex Platform
SendGrid / Twilio (Twilio Ireland Ltd, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland)	Transactional email delivery	US and EU	Flex Platform, Winner Flex, Spaces Flex
Workato (Workato Inc, 215 Castro St, Suite 300, Mountain View, CA 94041, USA; EU data centre: Frankfurt, Germany)	Integration and workflow automation	EU (Frankfurt)	Flex Platform
Optimizely (Optimizely AB, Box 7007, 103 86 Stockholm, Sweden)	Feature experimentation and split testing	EU	Flex Platform
Revenera / Flexera (Flexera Software LLC, 300 Park Blvd, Suite 500, Itasca, IL 60143, USA)*	Software licensing and usage analytics	US / EU	Flex Platform
TeamViewer (TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 Göppingen, Germany)	Remote support	EU (Germany)	All Products (support only)
Google LLC (Google Ireland Ltd, Gordon House, Barrow St, Dublin 4, D04 E5W5, Ireland)	Email integration and/or AI processing (activated features only)	Global; EU available	* Only where Customer activates a Google-dependent feature
Twilio (Twilio Inc., 101 Spear Street, Fifth Floor, San Francisco, CA 94105, USA)	SMS text messaging between dealer and dealer's customers	US	RFMS CRM App
Movate Technologies Private Limited, 6th Floor, Ambit IT Park, No. 32A & B, Ambit Road, Ambattur Industrial Estate, Chennai - 600058, India	Customer Support	India	Virtual Worlds, Fusion, Innoplus, SimpliPlan, M3B Badplaner, Room Survey, FurniData, FurniSuite, Rollmaster, JobRunner, FloorRight, RFMS, Measure Apps, Payments Flex, EQ, KOPAS, Winner Bizz, Retail One, Spaces Flex, Design Flex, Winner Flex, Office

*Listed for transparency. They act as sub-processors only to the extent they process PI on Customer's behalf. In other cases, Cyncly acts as the independent Controller of that data under clause 1.6.

Transfer safeguards. Where a sub-processor processes Customer Personal Data in a country outside the EEA, the UK or Switzerland that does not benefit from an adequacy decision, Cyncly relies on the EU-US Data Privacy Framework (where the sub-processor is certified under it) or on Standard Contractual Clauses (Module 3) with that sub-processor, together with the UK Addendum and Swiss adaptations where applicable.