Data Processing Addendum

"Data Protection Law" means any data protection or privacy law that applies to the relevant processing, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its applicable implementing regulations, Dubai Law No. 26 of 2015 Regulating Data Dissemination and Exchange in the Emirate of Dubai where applicable, and DIFC Law No. 5 of 2020 and its regulations only where they apply to the parties or processing.

The UAE has federal, free-zone, and sector-specific regimes. The federal law does not apply to every entity or category of data. Customer must notify ZorgSocial before using the Services for processing governed by DIFC or another special regime so the parties can agree any required terms. Mandatory law prevails over any inconsistent provision of this DPA.

• "Customer Personal Data" means Personal Data contained in Customer Content that ZorgSocial processes on Customer's behalf through the Services.
• "Controller" and "Processor" have the meanings given in the applicable Data Protection Law.
• "Subprocessor" means a third party engaged by or on behalf of ZorgSocial to process Customer Personal Data for the Services.

As between the parties, Customer acts as Controller (or equivalent decision-maker) and ZorgSocial acts as Processor for Customer Personal Data. The parties' processing subject matter, duration, nature, purposes, data types, and data-subject categories are described in Schedule 1 and are further determined by Customer's use and configuration of the Services.

ZorgSocial may process account, billing, service-operation, security, and support information for its own purposes as an independent Controller under the Agreement and its Privacy Policy. This DPA does not govern that independent processing.

Customer is responsible for the lawfulness, accuracy, quality, and means of collecting Customer Personal Data, providing required notices, establishing a lawful basis, obtaining any required permissions, and responding to data-subject requests. Customer will ensure its instructions and use of the Services comply with Data Protection Law and the rights of individuals.

Customer's documented instructions consist of the Agreement, this DPA, Customer's use and configuration of the Services, and any further written instructions agreed by ZorgSocial. ZorgSocial may suspend an instruction it reasonably believes violates law or the Agreement and will inform Customer unless prohibited by law. Customer remains responsible for determining whether the Services are suitable for its intended processing.

• Customer will not submit sensitive, health, biometric, government-identification, payment-card, children's, or other specially regulated data unless the Services expressly support that data and the parties first agree in writing on the required safeguards.
• Customer will not instruct ZorgSocial to sell, disclose, or use Customer Personal Data for advertising or any purpose unrelated to providing, securing, and supporting the Services.

ZorgSocial will process Customer Personal Data only on documented instructions, including to provide, secure, maintain, and support the Services, unless applicable law requires otherwise. Where legally permitted, ZorgSocial will notify Customer of that legal requirement before processing.

ZorgSocial will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations, implement appropriate technical and organizational measures as described in Schedule 2, and provide reasonable assistance with Customer's obligations under Data Protection Law as described in this DPA.

ZorgSocial will make available information reasonably necessary to demonstrate its compliance with this DPA, subject to the audit terms below and the protection of confidential information, security, and other customers' data.

Customer gives ZorgSocial general authorization to use Subprocessors to provide the Services. On request, ZorgSocial will provide information about its current Subprocessors. ZorgSocial will bind each Subprocessor to written data-protection obligations appropriate to its role and remains responsible for its Subprocessors to the extent required by applicable law.

• ZorgSocial will give notice of a material Subprocessor change through the Services or by email, where practicable at least 10 days before the change takes effect.
• Customer may object in writing within 10 days after notice, solely on reasonable data-protection grounds and with supporting details. The parties will work in good faith to address the objection. If no commercially reasonable solution is available, either party may terminate only the affected Service before the change takes effect; Customer's sole remedy is a refund of prepaid fees for the terminated portion covering the unused period, subject to the Agreement and applicable law.

Taking into account the nature of the processing, ZorgSocial will provide reasonable assistance, through available Service functionality and appropriate technical measures, to help Customer respond to requests to exercise data-subject rights. Customer is responsible for receiving, assessing, and responding to each request.

ZorgSocial will provide reasonable assistance with security, breach, impact-assessment, and regulator-consultation obligations to the extent required by applicable law and information reasonably available to ZorgSocial. Customer will reimburse reasonable costs for assistance that is not included in the Services, including assistance made necessary by Customer's instructions or use.

ZorgSocial will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. The notice will include information reasonably available at that time and may be supplemented as the investigation proceeds. Notice is not an admission of fault or liability.

Customer is responsible for determining whether to notify individuals, regulators, or other parties and for making those notifications. Unless required by law, ZorgSocial will not notify those parties on Customer's behalf without Customer's written instruction. Customer will provide reasonable cooperation and accurate contact details needed for incident communications.

ZorgSocial will maintain technical and organizational measures appropriate to the risks presented by the processing, taking into account the nature of the Customer Personal Data and the Services. The measures are summarized in Schedule 2 and may be updated as technology and security practices evolve, provided that ZorgSocial does not materially reduce the overall level of protection during the applicable subscription term.

No method of transmission or storage is completely secure. Except as expressly stated in the Agreement, ZorgSocial does not warrant that the Services will be uninterrupted or that unauthorized access can never occur.

Customer authorizes processing and access to Customer Personal Data in the locations where ZorgSocial and its Subprocessors operate, as disclosed on request or through the Services. ZorgSocial will use a transfer mechanism or safeguard required by applicable Data Protection Law before making a restricted international transfer.

Customer will provide information and cooperation reasonably required to document a transfer or implement a legally required safeguard. No provision authorizes a transfer that applicable law prohibits.

During the subscription term, Customer is responsible for exporting Customer Content using available Service functionality. After termination or expiry, ZorgSocial will, on Customer's written request made within 30 days, make Customer Personal Data available for export where technically feasible and then delete or return it within 90 days, unless applicable law requires retention.

ZorgSocial may retain copies in routine backups until overwritten in the ordinary course, and may retain information required for legal, security, dispute-resolution, or legitimate recordkeeping purposes. Retained data remains protected under this DPA and will not be used for other purposes.

On reasonable written request, ZorgSocial will provide information reasonably necessary to demonstrate compliance with this DPA, which may include relevant policies, security summaries, or independent audit materials where available. Customer may conduct one audit in any 12-month period, at its own expense, with at least 30 days' prior notice, during normal business hours, and subject to reasonable confidentiality and security requirements.

An on-site audit is permitted only where the information cannot reasonably be provided remotely or where required by a competent supervisory authority. Audits must not unreasonably disrupt operations, expose another customer's data, require access to source code, or disclose information unrelated to Customer Personal Data. Customer will promptly share findings relevant to the Services. Each party bears its own costs unless applicable law requires otherwise.

This DPA is subject to the exclusions, limitations, and procedures in the Agreement. To the fullest extent permitted by law, this DPA does not create a separate or increased liability cap or expand either party's liability beyond the Agreement. Nothing limits liability that cannot lawfully be limited.

If this DPA conflicts with the Agreement, this DPA controls only for the subject matter of processing Customer Personal Data by ZorgSocial as Processor. The Agreement controls all other matters. Customer may contact ZorgSocial about this DPA at legal@zorgsocial.com.