TrueStamp Data Processing Addendum (DPA)

Processor: Mohd Aquib Khan and Umar Raza Ansari, doing business as TrueStamp ("TrueStamp," "we," "us")

Privacy Contact: truestamp.privacy@gmail.com

This Data Processing Addendum ("DPA") is incorporated by reference into, and forms part of, the TrueStamp Business Terms of Service (the "Agreement") entered into between TrueStamp and the business customer identified in the Agreement (the "Business"). This DPA applies to the extent TrueStamp processes Customer Data on behalf of the Business in the course of providing the Services. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

By accepting the Agreement, the Business also accepts the terms of this DPA. In the event of a conflict between this DPA and the Agreement regarding the processing of Customer Data, this DPA prevails.

1. Definitions

1.1 "Controller" means the entity that determines the purposes and means of the processing of Customer Data. For the purposes of this DPA, the Business acts as Controller (and, where applicable under CCPA/CPRA, as "Business").

1.2 "Processor" means the entity that processes Customer Data on behalf of, and under the documented instructions of, the Controller. For the purposes of this DPA, TrueStamp acts as Processor (and, where applicable under CCPA/CPRA, as "Service Provider").

1.3 "Customer Data" means personal data that TrueStamp processes on behalf of the Business through the Services, including (a) personal data about the Business's end customers who participate in the Business's loyalty program (e.g., name, email address, phone number, stamp and redemption history, review content generated via the Services), and (b) personal data about the Business's own authorized users (e.g., staff or administrator accounts). Customer Data does not include data that TrueStamp collects and controls independently for its own purposes, such as account billing information or aggregated/anonymized usage analytics.

1.4 "Data Protection Law" means all data protection and privacy laws applicable to the processing of Customer Data under this DPA, including, as applicable: the General Data Protection Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"); and other comparable state, national, or regional data protection or privacy legislation applicable to the parties.

1.5 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data.

1.6 "Services" means the TrueStamp SaaS platform, comprising digital loyalty stamp cards and AI-generated review tooling accessed via QR code, as described in the Agreement.

1.7 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor), as further described in Section 8.

1.8 "Sub-processor" means any third party engaged by TrueStamp to process Customer Data in connection with providing the Services.

1.9 "Technical and Organizational Measures" or "TOMs" means the security measures described in Annex II.

2. Scope and Purpose of Processing

2.1 Role of the Parties. As between the parties, the Business is the Controller of Customer Data, and TrueStamp is the Processor. TrueStamp processes Customer Data solely on behalf of, and for the benefit of, the Business.

2.2 Purpose. TrueStamp processes Customer Data solely as necessary to provide the Services — namely, to operate the digital loyalty stamp card program, generate and manage AI-assisted review content, authenticate and manage Business and end-customer accounts, and provide related support, security, and platform functionality described in the Agreement. TrueStamp does not process Customer Data for any purpose independent of, or incompatible with, providing the Services, and does not sell Customer Data or use it to train third-party foundation models beyond what is strictly necessary to generate the review output requested through the Services.

2.3 Details of Processing. The subject matter, duration, nature, purpose, and categories of Customer Data and data subjects are further described in Annex I.

2.4 Business Instructions. TrueStamp will process Customer Data only on the documented instructions of the Business, including with regard to transfers of Customer Data to a third country, unless required to do otherwise by EU, UK, Swiss, or member state law to which TrueStamp is subject. In such a case, TrueStamp will inform the Business of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Agreement, this DPA, and the Business's ordinary configuration and use of the Services constitute the Business's complete documented instructions to TrueStamp as of the effective date of this DPA. Any additional or alternate instructions must be agreed to in writing (including by email to the Privacy Contact) and, if they require work beyond the standard functionality of the Services, may be subject to a separate agreement on fees and timing. TrueStamp will promptly notify the Business if, in its opinion, an instruction infringes Data Protection Law.

3. Processor Obligations

3.1 Confidentiality. TrueStamp ensures that any personnel authorized to process Customer Data have committed themselves to confidentiality (whether by contract or statutory duty) and are informed of the confidential nature of Customer Data.

3.2 Security of Processing. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects, TrueStamp implements and maintains the Technical and Organizational Measures set out in Annex II, designed to ensure a level of security appropriate to the risk — including, as applicable, encryption of Customer Data in transit and at rest, row-level security ("RLS") for tenant isolation in the underlying database, access controls, and measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems.

3.3 Personnel and Access. TrueStamp limits access to Customer Data to personnel who require such access to perform the Services, and ensures such personnel are subject to appropriate confidentiality obligations and receive appropriate training on their data protection responsibilities.

3.4 Sub-processing. TrueStamp may engage Sub-processors to process Customer Data only in accordance with Section 5 of this DPA.

3.5 Assistance to the Business. Taking into account the nature of the processing and the information available to TrueStamp, TrueStamp will provide reasonable assistance to the Business in ensuring compliance with the Business's obligations under Articles 32–36 of the GDPR (security, breach notification, data protection impact assessments, and prior consultation), including through the measures described in Sections 6 and 7 of this DPA.

3.6 No Independent Processing. TrueStamp will not process, transfer, sell, or otherwise use Customer Data for any purpose other than as instructed by the Business under this DPA and the Agreement, or as required by applicable law.

4. Business (Controller) Obligations

The Business represents and warrants that (a) it has provided all notices and obtained all consents, permissions, and rights necessary under Data Protection Law for TrueStamp to lawfully process Customer Data as contemplated by the Agreement and this DPA, and (b) its instructions for the processing of Customer Data comply with Data Protection Law. The Business is solely responsible for the accuracy, quality, and legality of Customer Data and the means by which it acquired Customer Data.

5. Sub-processors

5.1 General Authorization. The Business grants TrueStamp general written authorization to engage Sub-processors to process Customer Data, subject to the requirements of this Section 5. TrueStamp's current Sub-processors are listed in Section 11 of the TrueStamp Privacy Policy and reproduced for reference in Annex III to this DPA.

5.2 Sub-processor Obligations. TrueStamp imposes data protection terms on each Sub-processor that provide at least the same level of protection for Customer Data as those set out in this DPA, to the extent applicable to the nature of the services provided by that Sub-processor, including — where the Sub-processor processes Customer Data outside the EEA, UK, or Switzerland — an appropriate international transfer mechanism as described in Section 8. TrueStamp remains liable to the Business for the performance of each Sub-processor's obligations, in the same manner TrueStamp is liable for its own obligations under this DPA.

5.3 Changes to Sub-processors. TrueStamp will notify the Business of any intended addition or replacement of a Sub-processor by updating the subprocessor list referenced in Annex III and, where TrueStamp maintains a status or notification page for this purpose, by posting notice there, at least fourteen (14) days before the new Sub-processor begins processing Customer Data (except where a Sub-processor is engaged on an urgent basis to address a security or operational issue, in which case notice will be given as soon as reasonably practicable).

5.4 Objection Right. If the Business has a reasonable, documented objection to a new Sub-processor on data protection grounds, it must notify TrueStamp in writing within fourteen (14) days of the notice described in Section 5.3. The parties will discuss the objection in good faith with a view to reaching a resolution. If no resolution is reached within a further thirty (30) days, the Business's sole remedy is to terminate the Agreement, with respect only to the Services that cannot be provided without use of the objected-to Sub-processor, by written notice to TrueStamp, without penalty and (if applicable) with a pro-rated refund of prepaid, unused fees for the terminated Services.

6. Data Subject Rights

6.1 Self-Service Tools. TrueStamp provides self-service functionality within the Services that allows data subjects to exercise certain rights directly, including the ability to export their personal data (exportMyDataAction) and to delete their account and associated personal data (deleteMyAccountAction). The Business is encouraged to direct data subject requests to these tools in the first instance, where appropriate.

6.2 Assistance. Taking into account the nature of the processing, TrueStamp will provide the Business with reasonable assistance — through the self-service functionality described in Section 6.1, applicable platform features, and, where a request cannot be resolved through those means, reasonable manual support from TrueStamp — to enable the Business to respond to requests from data subjects to exercise their rights under Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection).

6.3 Requests Received Directly by TrueStamp. If TrueStamp receives a request directly from a data subject relating to Customer Data, TrueStamp will not respond to that request directly (except to acknowledge receipt and direct the data subject to the Business or to the self-service tools described in Section 6.1) unless legally required to do so, and will promptly notify the Business of the request, without undue delay, so that the Business can respond.

7. Personal Data Breach Notification

7.1 Notification. TrueStamp will notify the Business without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed Personal Data Breach affecting Customer Data.

7.2 Content of Notification. To the extent then known, TrueStamp's notification will describe: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects and Customer Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) the measures taken or proposed to address the Personal Data Breach, including measures to mitigate its possible adverse effects. Where not all information is available at the time of initial notification, TrueStamp will provide further information in phases as it becomes available, without undue delay.

7.3 Cooperation. TrueStamp will cooperate with the Business and take reasonable steps as directed by the Business to assist in the investigation, mitigation, and remediation of a Personal Data Breach, and to enable the Business to fulfil its own notification obligations to supervisory authorities and affected data subjects under Data Protection Law.

7.4 No Assessment of Fault. Notification of, or response to, a Personal Data Breach under this Section 7 will not be construed as an acknowledgment by TrueStamp of any fault or liability with respect to the Personal Data Breach.

8. International Data Transfers

8.1 Location of Processing. The Business acknowledges that TrueStamp and its Sub-processors may process Customer Data in the United States and other countries outside the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland, as identified in Annex III, in order to provide the Services.

8.2 Standard Contractual Clauses. Where the transfer of Customer Data from the Business to TrueStamp, or from TrueStamp to a Sub-processor, constitutes a restricted transfer under Data Protection Law (i.e., a transfer from the EEA, UK, or Switzerland to a country not deemed to provide an adequate level of data protection), the parties agree that the Standard Contractual Clauses, Module Two (Controller to Processor), are hereby incorporated into this DPA by reference and apply to such transfer as follows:

• the Business is the "data exporter" and TrueStamp is the "data importer";
• for transfers by TrueStamp to a Sub-processor, TrueStamp acts as "data exporter" on behalf of the Business pursuant to the authorization in Section 5, and the relevant Sub-processor is the "data importer," under Module Three (Processor to Processor) terms incorporated into TrueStamp's Sub-processor agreements;
• Clause 7 (the docking clause) is not used;
• in Clause 9, Option 2 (general written authorization) applies, with the time period for prior notice of Sub-processor changes as set out in Section 5.3 of this DPA;
• in Clause 11, the optional language is not used;
• in Clause 17, the SCCs are governed by the laws of Ireland;
• in Clause 18(b), disputes are resolved before the courts of Ireland;
• the details required by Annex I.A, I.B, and I.C of the SCCs are set out in Annex I to this DPA, and the technical and organizational measures required by Annex II of the SCCs are set out in Annex II to this DPA.

Where the UK Addendum to the SCCs (issued by the UK Information Commissioner's Office) or the Swiss FADP applies to a transfer, the parties agree that the UK Addendum, and/or the SCCs as amended for Swiss law, are incorporated by reference on equivalent terms, mutatis mutandis.

8.3 Independent of Adequacy Mechanisms. The parties agree that the Standard Contractual Clauses described in Section 8.2 apply independently of, and as a backup transfer mechanism to, any adequacy decision (including the EU-U.S. Data Privacy Framework and its UK and Swiss extensions) that may apply to a given transfer or Sub-processor. If a Sub-processor is self-certified under the Data Privacy Framework, that certification does not relieve TrueStamp of its obligation to ensure the SCCs (or another valid transfer mechanism) are also in place with respect to that Sub-processor.

8.4 Alternative Transfer Mechanism. If the Standard Contractual Clauses, as implemented under this DPA, are invalidated, amended, or superseded by a new lawful transfer mechanism, or if a competent authority or court requires a change, the parties will cooperate in good faith to implement a suitable alternative mechanism to ensure the lawfulness of ongoing transfers of Customer Data.

9. Term, Deletion, and Return of Customer Data

9.1 Term. This DPA remains in effect for as long as TrueStamp processes Customer Data on behalf of the Business under the Agreement.

9.2 Export Window. Upon termination or expiration of the Agreement, the Business will have thirty (30) days ("Export Window") to export Customer Data using the self-service tools described in Section 6.1 or by written request to the Privacy Contact.

9.3 Deletion. Following the expiration of the Export Window, TrueStamp will delete or irreversibly anonymize remaining Customer Data from its production systems within a commercially reasonable period, except to the extent TrueStamp is required by EU, UK, Swiss, U.S., or other applicable law to retain some or all of the Customer Data, in which case TrueStamp will isolate such retained data and continue to protect it in accordance with this DPA for as long as it is retained, and will process it only for the purpose(s) required by that law. Residual copies of Customer Data may persist in encrypted backups for a limited period consistent with TrueStamp's standard backup retention cycle, after which they are overwritten or deleted in the ordinary course.

9.4 Certification. Upon the Business's written request following completion of deletion under Section 9.3, TrueStamp will provide written confirmation that Customer Data has been deleted in accordance with this Section, except to the extent retained as permitted above.

10. Audit and Compliance

10.1 Information Rights. TrueStamp will make available to the Business, upon reasonable written request and no more than once every twelve (12) months (unless a Personal Data Breach has occurred, in which case additional requests are permitted), information reasonably necessary to demonstrate TrueStamp's compliance with its obligations under this DPA — such as a summary of the TOMs described in Annex II, responses to a reasonable, standard security questionnaire, and, if available, relevant third-party certifications, audit reports, or penetration test summaries.

10.2 Audit Scope. In lieu of on-site or third-party audits, the parties agree that the information exchange described in Section 10.1 satisfies TrueStamp's audit obligations under Data Protection Law, except where a supervisory authority with jurisdiction over the Business formally requires an on-site audit, in which case such audit will be conducted: (a) on reasonable prior written notice of no less than thirty (30) days; (b) during business hours; (c) no more than once every twelve (12) months absent a Personal Data Breach or legal requirement; (d) subject to reasonable confidentiality protections and without access to other customers' data or TrueStamp's proprietary systems beyond what is strictly necessary; and (e) at the Business's sole cost, unless the audit reveals a material breach of this DPA by TrueStamp, in which case TrueStamp bears its own reasonable costs of participation.

11. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA is intended to relieve either party of its own direct liability under Data Protection Law, including under Article 82 GDPR. As between the parties, each party remains responsible for its own compliance with Data Protection Law and, where a data subject or authority seeks compensation from one party for damage caused by the other party's processing, the parties will cooperate in good faith regarding any right of contribution available under applicable law.

12. General Provisions

12.1 Order of Precedence. This DPA forms part of, and is incorporated by reference into, the Agreement. In the event of a conflict between the terms of this DPA and the Agreement concerning the processing of Customer Data, this DPA prevails. In the event of a conflict between this DPA and the Standard Contractual Clauses incorporated under Section 8, the Standard Contractual Clauses prevail.

12.2 Governing Law. Except as otherwise specified for the Standard Contractual Clauses in Section 8.2, this DPA is governed by the same governing law and jurisdiction provisions set out in the Agreement.

12.3 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect, and the parties will work in good faith to replace the invalid provision with a valid one that most closely reflects the original intent.

12.4 Updates to This DPA. TrueStamp may update this DPA from time to time to reflect changes in Data Protection Law, its Sub-processors, or its processing activities, provided that any such update does not materially diminish the protections afforded to Customer Data under this DPA. Material updates will be communicated to the Business by email or through the Services in advance of taking effect.

12.5 Contact. All notices, requests, and communications under this DPA should be directed to truestamp.privacy@gmail.com.

Annex I — Details of Processing

A. List of Parties

B. Description of Transfer

• Categories of data subjects: End customers of the Business who participate in its loyalty program; authorized users (staff/administrators) of the Business.
• Categories of personal data: Name; email address; phone number (where provided); loyalty stamp and redemption transaction history; review content submitted or generated via the Services; account authentication identifiers (including OAuth identifiers); device and usage metadata reasonably necessary to operate the Services.
• Sensitive data: The Services are not designed to collect special categories of personal data (as defined in Article 9 GDPR), and the Business agrees not to submit such data through the Services.
• Frequency of transfer: Continuous, for as long as the Business uses the Services.
• Nature of processing: Collection, storage, organization, retrieval, use, and deletion of Customer Data to operate the loyalty and AI-review functionality of the Services.
• Purpose of processing: Provision of the Services to the Business, as described in Section 2 of this DPA.
• Duration of processing: For the term of the Agreement, plus the retention periods described in Section 9 of this DPA.
• Sub-processors: As listed in Annex III, engaged for the purposes and duration described there.

C. Competent Supervisory Authority

The competent supervisory authority is determined in accordance with Clause 13 of the Standard Contractual Clauses, based on the EEA member state in which the Business is established or has appointed a representative. If the Business has no such establishment or representative, the competent supervisory authority is the Irish Data Protection Commission.

Annex II — Technical and Organizational Measures

TrueStamp implements the following measures, designed to ensure a level of security appropriate to the risk associated with the processing of Customer Data:

• Encryption: Customer Data is encrypted in transit using TLS 1.2 or higher, and at rest using industry-standard encryption provided by TrueStamp's database and infrastructure providers.
• Tenant isolation: Multi-tenant Customer Data is logically segregated using row-level security (RLS) policies at the database layer, so that a Business can access only its own Customer Data.
• Access control: Access to production systems and Customer Data is restricted to authorized personnel on a least-privilege, role-based basis, and is reviewed periodically. Authentication to administrative systems requires unique credentials.
• Confidentiality: Personnel with access to Customer Data are bound by confidentiality obligations and are given appropriate guidance on their data protection responsibilities.
• Infrastructure security: The Services are hosted using reputable third-party infrastructure providers (as listed in Annex III) that maintain their own industry-standard physical, network, and platform security controls.
• Backups and resilience: Customer Data is backed up on a regular schedule to support restoration in the event of data loss, and backups are protected consistent with the measures described in this Annex.
• Vulnerability and patch management: TrueStamp applies security patches and dependency updates in a commercially reasonable timeframe based on severity.
• Incident response: TrueStamp maintains a process for identifying, escalating, and responding to security incidents, including the notification process described in Section 7 of this DPA.
• Data minimization: The Services are designed to collect only the Customer Data reasonably necessary to provide the loyalty and AI-review functionality described in the Agreement.
• Sub-processor oversight: TrueStamp performs reasonable diligence on Sub-processors before engagement and imposes contractual data protection obligations on them consistent with Section 5 of this DPA.

Annex III — List of Sub-processors

This list reflects the Sub-processors identified in Section 11 of the TrueStamp Privacy Policy as of the version date of this DPA. The current list is maintained in the TrueStamp Privacy Policy and updated in accordance with Section 5 of this DPA.