PREAMBLE

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the IDENRI Terms and Conditions and/or any separately executed master services agreement (the "Agreement") between IDENRI USA LLC, a company with its registered office at 30 North Gould Street, Suite N, Sheridan, WY 82801, United States, registered under number 2025-001669758 ("IDENRI", "we", "us") and the customer identified in the Agreement or in its IDENRI account (the "Customer"). Each is a "Party" and together the "Parties".

This DPA governs IDENRI's Processing of Personal Data on behalf of the Customer when the Customer uses the IDENRI contact data enrichment platform, including its waterfall enrichment service, web application, API and integrations (the "Services"). Capitalized terms not defined here have the meaning given in the Agreement or in applicable Data Protection Law. If this DPA conflicts with the Agreement on the subject of data protection, this DPA prevails.

1. DEFINITIONS

1.1. Data Protection Law means all laws and regulations relating to privacy, data protection, data security or the Processing of Personal Data that apply to a Party's performance under this DPA, including, as applicable: Regulation (EU) 2016/679 ("GDPR"); the UK Data Protection Act 2018 and UK GDPR; the Swiss Federal Act on Data Protection; and US state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

1.2. EU SCCs means the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced.

1.3. UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as amended or replaced.

1.4. Customer Personal Data means Personal Data that IDENRI Processes on behalf of the Customer under the Agreement, including the input data the Customer submits for enrichment (for example names, employers, company domains and professional profile URLs) and the enriched output returned to the Customer (for example business email addresses and phone numbers).

1.5. Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data Processed by IDENRI.

1.6. Sub-processor means a third party engaged by IDENRI to Process Customer Personal Data, including data providers that receive input data as part of the waterfall enrichment process.

1.7. The terms Personal Data, Controller, Processor, Business, Service Provider, Sell, Share, Data Subject, Process/Processing and Supervisory Authority have the meanings given in the applicable Data Protection Law.

2. ROLES AND DESCRIPTION OF PROCESSING

2.1. Roles: For Customer Personal Data, the Customer acts as Controller (or as Processor on behalf of its own clients, in which case IDENRI acts as Sub-processor) and IDENRI acts as Processor (or Service Provider under CCPA/CPRA). IDENRI acts on behalf of the Customer and on its documented instructions.

2.2. Details of Processing: The subject matter, nature, purpose and duration of the Processing, the categories of Data Subjects and the types of Personal Data are described in Annex I.

2.3. Purpose limitation: IDENRI Processes Customer Personal Data only to provide the Services and as otherwise described in this DPA.

3. INSTRUCTIONS

3.1. IDENRI Processes Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by Union, Member State or other applicable law. In that case IDENRI informs the Customer of the legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest.

3.2. The Agreement, this DPA, the Customer's use and configuration of the Services (including API calls and enrichment requests) and any further written instructions constitute the Customer's complete documented instructions.

3.3. IDENRI will inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law.

4. CUSTOMER RESPONSIBILITIES

4.1. The Customer is responsible for the lawfulness of the Personal Data it submits and of its instructions. In particular, the Customer will:

• Identify and document a valid legal basis for its Processing (for example legitimate interests or consent), and provide Data Subjects with all notices required by Data Protection Law;
• Comply with applicable electronic communications, anti-spam and telemarketing rules when it uses enriched email addresses and phone numbers, including rules on prior consent, do-not-call registers and unsubscribe mechanisms;
• Honor Data Subject rights and opt-out requests, and maintain its own suppression lists;
• Use the Services only for lawful B2B prospecting, recruitment and related business purposes, and in compliance with the Acceptable Use rules in the Agreement.

4.2. No restricted data: Unless the Parties expressly agree in writing and put appropriate safeguards in place, the Customer will not submit special categories of Personal Data (GDPR Art. 9), data relating to criminal convictions and offences (Art. 10), health data subject to sector rules such as HIPAA, payment card data, children's data, or other sector-specific regulated data.

5. IDENRI AS INDEPENDENT CONTROLLER (LIMITED)

Separately from its role as Processor, IDENRI may Process certain Personal Data as an independent Controller, for example for account creation and management, billing, security and abuse prevention, compliance with legal obligations, maintaining opt-out and suppression records, and producing aggregated or de-identified analytics to operate and improve the Services. That Processing is described in the IDENRI Privacy Policy and is outside the scope of this DPA. IDENRI will not use Customer Personal Data to build or enrich a database for the benefit of other customers except as stated in the Agreement and the IDENRI Privacy Policy and permitted by Data Protection Law.

6. CONFIDENTIALITY

IDENRI ensures that personnel authorized to Process Customer Personal Data are bound by confidentiality obligations and have access only to the extent strictly necessary to provide, manage and monitor the Services.

7. SECURITY

7.1. IDENRI implements and maintains the technical and organizational measures described in Annex II to protect Customer Personal Data against Security Incidents, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects.

7.2. IDENRI regularly reviews and updates these measures. Updates will not materially reduce the overall level of protection.

8. SUB-PROCESSORS

8.1. General authorization: The Customer gives IDENRI general authorization to engage Sub-processors. The current list is set out in Annex III and published on the IDENRI website.

8.2. Changes: IDENRI will notify the Customer (by email, in-app notice or by updating the published list with a subscription option) at least fourteen (14) days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. The Parties will work in good faith to resolve the objection. If no resolution is reached, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period.

8.3. Flow-down: IDENRI imposes on each Sub-processor data protection obligations no less protective than those in this DPA and remains fully liable to the Customer for the performance of its Sub-processors.

8.4. Waterfall data sources: Where a third-party data provider receives Customer input data in order to return enrichment results, that provider is a Sub-processor and is listed in Annex III. Where a provider only supplies data from its own independently held database without receiving Customer Personal Data other than the lookup query, IDENRI will contractually require that provider to have a lawful basis for the data it supplies.

9. INTERNATIONAL TRANSFERS

9.1. IDENRI transfers Customer Personal Data outside the EEA, the UK or Switzerland only on the Customer's documented instructions (which include the use of the Services as described in this DPA) or where required by law, and in accordance with Chapter V of the GDPR.

9.2. EU SCCs: Where Customer Personal Data subject to the GDPR is transferred to IDENRI or its Sub-processors in a country without an adequacy decision, the EU SCCs are incorporated by reference and deemed executed by the Parties on acceptance of this DPA, with the Customer as data exporter and IDENRI as data importer. Module Two (Controller to Processor) applies where the Customer is a Controller, and Module Three (Processor to Processor) applies where the Customer is a Processor. The EU SCCs are completed as follows: Clause 7 (docking clause) does not apply; in Clause 9(a) Option 2 (general written authorization) applies with the notice period in Section 8.2; in Clause 11 the optional independent dispute resolution language does not apply; in Clause 17 the law of France governs; in Clause 18(b) the courts of France have jurisdiction; Annexes I.A, I.B and II are completed by Annexes I and II of this DPA, and Annex III lists the Sub-processors. The competent Supervisory Authority is identified in Annex I, Part C.

9.3. UK transfers: For Personal Data subject to the UK GDPR, the UK Addendum is incorporated and completed as set out in Annex IV.

9.4. Switzerland: For Personal Data subject to the Swiss FADP, the EU SCCs apply with references to the GDPR read as references to the FADP, references to a Member State read as Switzerland, and the Swiss Federal Data Protection and Information Commissioner as competent authority.

9.5. Sub-processor transfers: IDENRI may use the EU SCCs or another valid transfer mechanism with Sub-processors for onward transfers.

9.6. Supplementary measures: Where required, the Parties will cooperate in good faith to implement supplementary measures and to complete transfer impact assessments.

9.7. In case of conflict between this DPA and the EU SCCs or the UK Addendum, the EU SCCs or UK Addendum prevail.

10. DATA SUBJECT REQUESTS

10.1. IDENRI will promptly inform the Customer if it receives a request from a Data Subject relating to Customer Personal Data, and will not respond except to redirect the Data Subject to the Customer, unless required by law or instructed by the Customer.

10.2. Taking into account the nature of the Processing, IDENRI will provide reasonable assistance, by appropriate technical and organizational measures, to enable the Customer to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection.

10.3. Opt-outs made directly to IDENRI: Where a Data Subject submits an opt-out, deletion or "do not sell or share" request through IDENRI's own opt-out channel, the request is deemed addressed to IDENRI as an independent Controller (see Section 5). IDENRI may honor it, including by suppressing the person's data from future enrichment results, without notifying the Customer.

11. ASSISTANCE WITH COMPLIANCE

Taking into account the nature of Processing and the information available to it, IDENRI will provide reasonable assistance to the Customer with a) data protection impact assessments where Processing is likely to result in a high risk to Data Subjects, b) prior consultation with Supervisory Authorities, and c) the Customer's security and breach notification obligations under Articles 32 to 34 of the GDPR.

12. SECURITY INCIDENTS

12.1. IDENRI will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident.

12.2. The notification will include, to the extent known: the nature of the Security Incident, including the categories and approximate number of Data Subjects and records concerned; a contact point where more information can be obtained; the likely consequences; and the measures taken or proposed to address the Security Incident and mitigate its effects. Where all information is not available at once, IDENRI will provide it in phases without undue further delay.

12.3. IDENRI will take reasonable steps to contain, investigate and remediate the Security Incident. A notification is not an admission of fault or liability.

13. DOCUMENTATION AND AUDITS

13.1. IDENRI will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, for example summaries of security controls and, where available, third-party reports or certifications. Requests may be made no more than once in any 12-month period, unless required by a Supervisory Authority or following a Security Incident.

13.2. If that information does not reasonably demonstrate compliance, or where required by Data Protection Law, the Customer may audit IDENRI's relevant Processing, itself or through an independent auditor bound by confidentiality, on thirty (30) days' written notice, during normal business hours, no more than once every 12 months, and without unreasonably disrupting IDENRI's operations. Scope and timing will be agreed in advance. Each Party bears its own costs, except that the Customer reimburses IDENRI's reasonable costs for audits beyond one per year or beyond a reasonable effort of its personnel.

13.3. IDENRI will make the information in this Section, including audit results, available to the competent Supervisory Authority on request and will reasonably cooperate with Supervisory Authorities in relation to the Processing under this DPA.

14. RETENTION, RETURN AND DELETION

14.1. Retention during the Agreement. Unless the Customer configures a shorter period, IDENRI retains the Customer's enrichment inputs and results in the Customer's account for up to 90 days after processing, and then deletes them automatically. The Customer can export or delete its data at any time using the Services.

14.2. After termination. Within thirty (30) days after the Agreement ends, IDENRI will delete or, at the Customer's written choice made before the end of that period, return all Customer Personal Data, and delete existing copies, unless Union, Member State or other applicable law requires longer retention. In that case IDENRI will keep protecting the data in accordance with this DPA and delete it as soon as legally permissible.

14.3. Backups are overwritten in the ordinary course within 30 days, and remain protected under this DPA until then.

15. US STATE PRIVACY LAWS

To the extent IDENRI Processes Personal Information subject to CCPA/CPRA or similar US state privacy laws on the Customer's behalf, IDENRI acts as a Service Provider (or Processor) and will not:

• Sell or Share that Personal Information (including for cross-context behavioral advertising);
• Retain, use or disclose it for any purpose other than the business purposes specified in the Agreement and this DPA, or outside the direct business relationship between IDENRI and the Customer, except as permitted by law;
• Combine it with Personal Information received from other sources or collected from its own interactions with consumers, except as permitted by law;
• Attempt to re-identify de-identified information.

IDENRI will provide reasonable assistance with consumer requests, will notify the Customer if it can no longer meet its obligations under those laws, will impose equivalent restrictions on subcontractors, and will, upon the Customer's reasonable request, certify its compliance with this Section. The Customer may take reasonable steps to stop and remediate unauthorized use of Personal Information.

16. LIABILITY AND ORDER OF PRECEDENCE

16.1. Each Party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits liability to Data Subjects under the EU SCCs or the UK Addendum, or any liability that cannot be limited by law.

16.2. In case of conflict, the order of precedence is: (1) the EU SCCs and UK Addendum; (2) this DPA; (3) the Agreement.

17. TERM, SUSPENSION AND CHANGES

17.1. Term: This DPA takes effect on the effective date of the Agreement (or the date the Customer accepts it, if later) and remains in force for as long as IDENRI Processes Customer Personal Data.

17.2. Suspension and termination: If IDENRI breaches this DPA, the Customer may instruct IDENRI to suspend Processing until compliance is restored or the Agreement is terminated. IDENRI will promptly inform the Customer if it cannot comply with this DPA for any reason. The Customer may terminate this DPA and the affected Services if Processing has been suspended and compliance is not restored within two (2) months. IDENRI may terminate the affected Services if, after being informed that an instruction infringes Data Protection Law, the Customer insists that it be followed.

17.3. Changes: IDENRI may update this DPA to reflect changes in law, regulatory guidance or the Services, with notice to the Customer in accordance with the Agreement. Changes will not reduce the protections described here. The Customer may object within thirty (30) days of notice, and the Parties will discuss the objection in good faith.

17.4. Governing law: Subject to the EU SCCs and UK Addendum, which specify their own governing law and forum, this DPA is governed by the law and subject to the jurisdiction stated in the Agreement.

18. CONTACT

Questions about this DPA or requests to exercise rights: privacy@idenri.com.

Mailing address: 322 Culver Boulevard, Suite, Playa del Rey, CA 90292, United States.

ANNEX I

DESCRIPTION OF PROCESSING

A. LIST OF PARTIES

Data exporter: The Customer, identified by the name, address and contact details in its IDENRI account or the Agreement. Role: Controller (or Processor on behalf of its clients). Activities: B2B prospecting, sales, marketing and recruitment.

Data importer: IDENRI USA LLC, 30 North Gould Street, Suite N, Sheridan, WY 82801, United States. Contact: privacy@idenri.com. Role: Processor (or Sub-processor). Activities: contact data enrichment services.

B. DESCRIPTION OF PROCESSING

• Categories of Data Subjects: Business professionals, such as the Customer's prospects, leads, contacts and candidates, or those of the Customer's own clients.
• Categories of Personal Data: Input data provided by the Customer, such as name, job title, employer, company domain, professional profile URL, and any existing contact details. Output data returned by the Services, such as business email address, business and mobile phone number, email deliverability status, job title and company information.
• Sensitive data: None anticipated. See Section 4.2.
• Frequency: Continuous, depending on the Customer's use of the Services (one-off, batch or API requests).
• Nature of Processing: Receipt, matching, querying of data sources through the waterfall process, verification, structuring, temporary storage, transmission of results, and deletion.
• Purposes: to enrich contact data so that the Customer (or its clients) can carry out B2B prospecting or recruitment activities, and to provide, secure and support the Services.
• Duration and retention: The term of the Agreement. Enrichment inputs and results are stored for the period in Section 14 and then deleted.
• Sub-processor transfers: Sub-processors Process Customer Personal Data for the purposes above and for the duration of the Agreement, as listed in Annex III.

C. COMPETENT SUPERVISORY AUTHORITY

The Supervisory Authority of the EU Member State in which the Customer is established or, if the Customer is not established in the EU, in which its EU representative is located.

ANNEX II

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

IDENRI maintains the following measures, which may be updated from time to time in accordance with Section 7.2.

1. Governance and access control:. Role-based access control; unique credentials; multi-factor authentication for privileged and administrative access; least-privilege and need-to-know; periodic access reviews; prompt revocation on role change or departure.

2. Encryption and pseudonymization: Encryption in transit using TLS; encryption at rest using industry-standard algorithms; secure password hashing; restricted key management; pseudonymized identifiers in logs where feasible.

3. Network and infrastructure: Firewalls and network segmentation; private networking for databases; system hardening and regular patching; vulnerability scanning with risk-based remediation; DDoS protection.

4. Confidentiality: Integrity, availability and resilience. Logical separation of customer data; redundancy of critical components; documented backup and recovery procedures with periodic testing.

5. Monitoring and logging: Centralized logging of access and administrative actions (user, role, action, IP address, time), protected against tampering, with security event alerting and a defined log retention period.

6. Application security: Secure development lifecycle; code review; dependency and secrets management; automated and manual testing, including security testing.

7. Incident response: Documented incident response plan with defined roles, containment, investigation, customer notification and post-incident review.

8. Personnel: Confidentiality undertakings; background checks where lawful; regular security and privacy training.

9. Vendor management: Security and privacy due diligence on Sub-processors; contractual flow-down of data protection obligations; ongoing monitoring based on risk.

10. Physical security: Hosting with reputable infrastructure providers that maintain recognized physical and environmental security controls and independent security certifications.

11. Data minimization and retention: Only data needed for enrichment is processed; each dataset has a defined retention period and is deleted automatically on expiry; configurable retention for Customers.

12. Change management and testing: Documented change control, rollback plans, and regular evaluation of the effectiveness of technical and organizational measures.

ANNEX III

AUTHORIZED SUB-PROCESSORS

At the date of this DPA it includes the following categories in accordance with Section 8.2:

• Cloud hosting and infrastructure: Digital Ocean;
• Waterfall enrichment data providers (those that receive input data): Renidly and Mercator Union;
• Email verification and phone validation: COMPANY;
• Payment processing: Stripe.

For each Sub-processor, the published list states the name and the Processing performed.

ANNEX IV

UK ADDENDUM

For Personal Data subject to the UK GDPR, the UK Addendum is incorporated and completed as follows:

• Table 1 (Parties): As in Annex I.A.
• Table 2 (Selected SCCs): The EU SCCs as completed in Section 9.2, with the optional Clause 7 not applied.
• Table 3 (Appendix Information): Annexes I to III of this DPA.
• Table 4 (Ending the Addendum when the Approved Addendum changes): Neither Party may end the UK Addendum on that basis, unless the Parties agree otherwise.
• Start date: The effective date of this DPA. Governing law and forum: England and Wales, unless the UK Addendum requires otherwise.