Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Agreement between SmartDry Technologies Limited, company number 17302780, whose registered office is at 3 Colndale Road Floor 1, Colnbrook, Slough, England, SL3 0HQ ("SmartDry") and the Customer.

This DPA is automatically incorporated into the Agreement whenever SmartDry processes Customer Personal Data as a Processor or Subprocessor on behalf of the Customer. No separate signature is required unless the parties choose to execute this DPA separately.

This DPA is intended to satisfy the requirements of Article 28 of the UK GDPR and, where applicable, Article 28 of the EU GDPR. It must be read together with the SmartDry Master Software & Services Terms, the applicable Order Form and any Security Schedule or Product-Specific Terms.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the Master Terms. In this DPA:

"Applicable Data Protection Law" means all data-protection and privacy laws applicable to the Processing of Customer Personal Data under the Agreement, including the UK GDPR, the Data Protection Act 2018 as amended (including by the Data (Use and Access) Act 2025), the EU GDPR where applicable, and any legislation implementing, replacing or supplementing them.

"Controller" has the meaning given under Applicable Data Protection Law and includes a "data controller" where that terminology is used.

"Data Subject" means an identified or identifiable natural person to whom Customer Personal Data relates.

"EU GDPR" means Regulation (EU) 2016/679 as it applies in the European Economic Area.

"EU SCCs" means the European Commission standard contractual clauses for transfers of personal data to third countries adopted under Commission Implementing Decision (EU) 2021/914, as amended, replaced or superseded.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed.

"Processing" or "Process" has the meaning given under Applicable Data Protection Law.

"Processor" has the meaning given under Applicable Data Protection Law and includes a "data processor" where that terminology is used.

"Restricted Transfer" means a transfer of Personal Data that requires an adequacy mechanism, appropriate safeguard or other transfer mechanism under Applicable Data Protection Law.

"Subprocessor" means a third party appointed by or on behalf of SmartDry to Process Customer Personal Data in connection with the Services.

"Supervisory Authority" means the Information Commissioner or another data-protection supervisory authority competent in relation to the relevant Processing.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as revised in accordance with its mandatory clauses.

"UK GDPR" means Regulation (EU) 2016/679 as it forms part of UK law and is amended from time to time.

"UK IDTA" means the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as revised in accordance with its mandatory clauses.

2. Scope, Incorporation and Precedence

2.1 Scope

This DPA applies only to Processing of Customer Personal Data by SmartDry as Processor or, where the Customer itself acts as a Processor, as Subprocessor. It does not govern Processing for which SmartDry acts independently as Controller, which is addressed in Section 17.

2.2 Automatic incorporation

This DPA becomes binding automatically when SmartDry first Processes Customer Personal Data as Processor or Subprocessor under the Agreement and remains in force for so long as SmartDry Processes such Customer Personal Data.

2.3 Precedence

For matters concerning SmartDry's Processing of Customer Personal Data as Processor or Subprocessor, this DPA prevails over conflicting provisions of the Master Terms, an Order Form, Product-Specific Terms or other incorporated documents to the extent of the conflict. A general statement that an Order Form overrides other documents is not sufficient to amend this DPA.

This DPA may be specifically amended only where the relevant amendment identifies the provision being changed, expressly states the parties' intention to change it, is agreed by authorised representatives of both parties, and remains compliant with Applicable Data Protection Law.

2.4 Version control

SmartDry will maintain reasonable evidence of the DPA version applicable to the Customer, including by version number, effective date, contracting record or stable version-specific identifier, in accordance with the Master Terms.

3. Roles of the Parties

3.1 Customer as Controller

Where the Customer determines the purposes and means of Processing Customer Personal Data, the Customer is Controller and SmartDry is Processor.

3.2 Customer as Processor

Where the Customer Processes Customer Personal Data on behalf of another Controller, the Customer acts as Processor and SmartDry acts as the Customer's Subprocessor. In that case, the Customer warrants that it is authorised by the relevant Controller to appoint SmartDry and to give the instructions described in this DPA.

3.3 Separate Processing activities

The parties acknowledge that their roles must be assessed by reference to each distinct Processing activity. SmartDry does not become Controller of Customer Personal Data merely because it determines technical or organisational means necessary to provide the Services, provided it continues to Process that data only for the Customer's documented purposes and instructions.

3.4 No joint controllership by default

Nothing in the Agreement creates joint controllership between the parties. If a particular future feature genuinely creates a joint-controller relationship, the parties will put in place any arrangement required by Applicable Data Protection Law before relying on that relationship.

4. Documented Processing Instructions

4.1 Customer instructions

SmartDry will Process Customer Personal Data only on the Customer's documented instructions, including with respect to Restricted Transfers, unless SmartDry is required to Process the data by applicable law.

The Customer's documented instructions include:

• the Agreement, Order Form and applicable Product-Specific Terms;
• the Customer's configuration and authorised use of the Services;
• instructions submitted through SmartDry administrative controls, APIs or supported workflows;
• written instructions given through authorised support or account-management channels; and
• the Processing activities described in Schedule 1.

4.2 Legally required Processing

If SmartDry is required by law to Process Customer Personal Data other than on the Customer's documented instructions, SmartDry will inform the Customer of that legal requirement before Processing unless the law prohibits such notice for important grounds of public interest.

4.3 Unlawful instructions

If SmartDry reasonably believes a Customer instruction infringes Applicable Data Protection Law, SmartDry will inform the Customer without undue delay. SmartDry may suspend the affected Processing while the parties work in good faith to resolve the issue, but will not suspend unrelated Services where this is not reasonably necessary.

4.4 Changes to instructions

Material additional instructions that are outside the documented scope of the Services may require a written change to the Order Form, reasonable technical implementation time and/or additional Fees. This does not restrict the Customer's rights under Applicable Data Protection Law.

5. Customer Data-Protection Obligations

The Customer is responsible for its own compliance with Applicable Data Protection Law and, in particular, for ensuring that:

• it has a valid lawful basis for the collection, use and disclosure of Customer Personal Data to SmartDry;
• it provides all privacy information and notices required to Data Subjects;
• its instructions to SmartDry are lawful, fair, transparent and within the scope of the Agreement;
• Customer Personal Data is relevant, reasonably accurate and limited to what is necessary for the Customer's purposes;
• it has any consent, authorisation or other permission required for Customer-controlled communications, images, location data or other Processing it enables;
• where it acts as Processor, its instructions and appointment of SmartDry are authorised by the relevant Controller; and
• it does not use the Services to Process Personal Data in a manner prohibited by the Agreement or Applicable Data Protection Law.

5.1 Special category and criminal-offence data

SmartDry's core Services do not require the Customer to submit special-category Personal Data or criminal-offence data. The Customer must not intentionally submit such data unless the relevant Processing is necessary for a supported business purpose, is lawful, is within the agreed scope of the Services and the Customer has satisfied all additional legal conditions applying to that Processing.

The parties acknowledge that sensitive information may occasionally be incidentally visible in free-text notes, photographs, communications or other Customer-provided content. Where such information constitutes Customer Personal Data, SmartDry will Process it under this DPA.

5.2 Payment-card data

Unless Payment Services Terms expressly state otherwise, the Services are not intended to be a repository for raw payment-card credentials. The Customer must not intentionally enter full card numbers, security codes or other raw cardholder authentication data into free-text fields, garment records or other unsupported parts of the Services.

6. Confidentiality and Personnel

SmartDry will ensure that persons authorised to Process Customer Personal Data:

• are subject to an appropriate contractual or statutory duty of confidentiality;
• receive access only where reasonably necessary for their duties;
• are informed of relevant security and privacy obligations; and
• Process Customer Personal Data only in accordance with this DPA and SmartDry's authorised procedures.

SmartDry will maintain proportionate controls over privileged and support access to Customer environments and will remove or modify access when it is no longer required.

7. Security of Processing

7.1 Security measures

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the risk to individuals, SmartDry will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The current categories of measures are described in Schedule 2 and may be supplemented by an applicable Security Schedule.

7.2 Security changes

SmartDry may update its security measures from time to time to reflect technological, operational, legal or threat changes, provided that SmartDry will not materially reduce the overall level of protection for Customer Personal Data during a committed Subscription Term without a lawful and reasonable basis.

7.3 Customer security responsibilities

The Customer remains responsible for security measures under its control, including appropriate user access, endpoint security, password and authentication practices, permissions, connected systems, Customer-controlled integrations and secure handling of exported Customer Personal Data.

8. Personal Data Breaches

8.1 Notification

SmartDry will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 Information

To the extent reasonably available, SmartDry will provide information sufficient to assist the Customer in meeting applicable breach-notification obligations, including:

• the nature of the Personal Data Breach;
• the categories of affected Customer Personal Data and Data Subjects;
• the likely consequences of the Personal Data Breach;
• measures taken or proposed to address and mitigate the breach; and
• a contact point for reasonable follow-up questions.

SmartDry may provide information in phases where complete information is not immediately available.

8.3 Investigation and mitigation

SmartDry will take reasonable steps to contain, investigate and mitigate the Personal Data Breach and will reasonably cooperate with the Customer. SmartDry's notification of or response to a Personal Data Breach is not an admission of fault or liability.

8.4 Regulatory and Data Subject notifications

Unless required by law to do so independently, SmartDry will not notify a Supervisory Authority or affected Data Subjects on the Customer's behalf without the Customer's instruction. The Customer remains responsible for determining whether notifications are legally required and for making them within applicable deadlines.

9. Data Subject Rights

Taking into account the nature of the Processing, SmartDry will provide appropriate technical and organisational assistance, insofar as reasonably possible, to enable the Customer to respond to requests by Data Subjects exercising rights under Applicable Data Protection Law.

9.1 Requests received by SmartDry

If SmartDry receives a request directly from a Data Subject concerning Customer Personal Data for which the Customer is Controller, SmartDry will, where reasonably able to identify the relevant Customer, forward the request to the Customer without undue delay and will not substantively respond except:

• on the Customer's documented instruction;
• to confirm that SmartDry has referred the request to the relevant Customer where appropriate; or
• where SmartDry is legally required to respond.

9.2 Assistance costs

Standard self-service functionality and reasonable routine assistance are included in the Services. Where a request requires material bespoke engineering, extensive manual work or assistance outside ordinary platform functionality, SmartDry may charge reasonable costs agreed or notified in advance, except to the extent the work is required because of SmartDry's breach of this DPA.

10. Assistance With Controller Compliance

Taking into account the nature of Processing and the information available to SmartDry, SmartDry will provide reasonable assistance to the Customer with its obligations relating to:

• security of Processing;
• Personal Data Breach assessment and notifications;
• data protection impact assessments;
• prior consultation with a Supervisory Authority where required; and
• other obligations under Articles 32 to 36 of the UK GDPR or equivalent provisions of Applicable Data Protection Law.

SmartDry may provide information about the Services, Processing, security controls and Subprocessors that the Customer reasonably requires for such assessments. The Customer remains responsible for its own assessment, decision-making and filings as Controller.

11. Subprocessors

11.1 General authorisation

The Customer gives SmartDry general written authorisation to appoint Subprocessors to Process Customer Personal Data for the purposes of providing the Services, subject to this Section.

11.2 Subprocessor register

SmartDry will maintain a current Subprocessor Register identifying the Subprocessors used for Customer Personal Data, their principal Processing purpose and sufficient information about relevant Processing locations or transfer arrangements. The current register will be made available through SmartDry's Legal Centre, contracting record or another durable method reasonably accessible to the Customer.

The initial register applicable when the Customer contracts will form part of the Customer's contracting record. The inclusion of a provider in the register does not mean that provider receives every Customer's data; access depends on the Services and features actually used.

11.3 Changes and notice

SmartDry will give the Customer reasonable prior notice of an intended new Subprocessor or material replacement where that Subprocessor will Process Customer Personal Data. Notice may be provided electronically, including through the Customer account, Legal Centre or a designated notice email address.

11.4 Customer objection

The Customer may object to a new Subprocessor on reasonable and documented data-protection grounds by notifying SmartDry within 14 days after notice. The parties will work in good faith to address the objection, including by considering reasonable technical or commercial alternatives.

If the parties cannot resolve a legitimate objection and SmartDry cannot reasonably avoid use of the Subprocessor, the Customer may terminate only the materially affected Service on written notice before the Subprocessor begins Processing the Customer's data and will receive a pro-rata refund of prepaid recurring Fees for the unused period of that terminated Service. This is the Customer's sole contractual remedy for an unresolved Subprocessor objection, without limiting rights that cannot lawfully be restricted.

11.5 Flow-down obligations

SmartDry will enter into a written agreement with each Subprocessor imposing data-protection obligations that provide an equivalent level of protection for Customer Personal Data as required by Article 28 and this DPA, having regard to the nature of the Subprocessor's Processing.

11.6 Responsibility

SmartDry remains responsible to the Customer for the performance of a Subprocessor's data-protection obligations to the extent required by Applicable Data Protection Law and subject to the liability provisions of the Agreement.

12. International and Restricted Transfers

12.1 General rule

SmartDry will not make a Restricted Transfer of Customer Personal Data unless the transfer is permitted under Applicable Data Protection Law.

12.2 Transfer mechanisms

Where a Restricted Transfer is not covered by an applicable adequacy regulation or decision, SmartDry will use an appropriate safeguard or other lawful transfer mechanism, which may include:

• the UK IDTA;
• the UK Addendum together with applicable EU SCCs;
• the EU SCCs where the EU GDPR applies;
• binding corporate rules or another legally recognised safeguard; or
• a lawful derogation where the conditions for that derogation are genuinely satisfied.

12.3 Data protection test / transfer risk assessment

Where Applicable Data Protection Law requires a data protection test, transfer risk assessment or equivalent assessment before reliance on an appropriate safeguard, SmartDry will complete or procure the required assessment for Restricted Transfers initiated by SmartDry and implement reasonable supplementary measures where necessary.

12.4 Customer-to-SmartDry Restricted Transfers

If a transfer from the Customer to SmartDry becomes a Restricted Transfer and no adequacy mechanism applies, the applicable transfer terms in Schedule 4 are incorporated automatically to the extent legally required, unless the parties agree another valid safeguard.

12.5 Subprocessor transfers

Where SmartDry initiates a Restricted Transfer to a Subprocessor, SmartDry will ensure that the relevant transfer is covered by a lawful transfer mechanism. The Customer authorises SmartDry to enter into transfer instruments with Subprocessors on the Customer's behalf where this is legally permitted and necessary to give effect to the Services.

12.6 Cooperation

The parties will reasonably cooperate to provide information and execute additional transfer documentation where this is legally required and cannot validly be incorporated by reference or entered into by SmartDry alone.

13. Records, Information, Audits and Inspections

13.1 Records and information

SmartDry will maintain records of Processing to the extent required by Applicable Data Protection Law and will provide the Customer with information reasonably necessary to demonstrate SmartDry's compliance with the Processor obligations in Article 28 and this DPA.

13.2 Compliance materials

Where appropriate, SmartDry may satisfy routine audit and information requests by providing available compliance materials such as security descriptions, completed questionnaires, independent audit summaries or reports, penetration-test summaries, policy extracts or other reasonable evidence, subject to confidentiality and security restrictions.

13.3 Customer audits

If the information described above is not reasonably sufficient to demonstrate compliance, the Customer may conduct an audit itself or through an independent auditor that is not a direct competitor of SmartDry, subject to the following conditions:

• the audit must relate specifically to SmartDry's Processing of Customer Personal Data under this DPA;
• the Customer must normally provide at least 30 days' written notice;
• audits must occur during normal business hours and must not unreasonably disrupt SmartDry's operations or compromise other customers' information or security;
• the auditor must be bound by appropriate confidentiality obligations;
• the Customer may not access another customer's data, source code, vulnerability details that would create a security risk, or unrelated SmartDry Confidential Information;
• routine audits are limited to once in any 12-month period unless a Personal Data Breach, material compliance concern, regulatory request or Applicable Data Protection Law reasonably requires an additional audit; and
• the Customer bears its own and SmartDry's reasonable incremental audit costs unless the audit identifies material non-compliance by SmartDry, in which case SmartDry will bear its reasonable internal costs of remediation and cooperation.

13.4 Supervisory Authority

Nothing in this Section restricts the lawful audit, inspection or investigative powers of a competent Supervisory Authority.

14. Government and Law-Enforcement Requests

If SmartDry receives a legally binding request from a public authority for disclosure of Customer Personal Data, SmartDry will, to the extent legally permitted:

• notify the Customer before disclosure;
• review the request for apparent legal validity and scope;
• seek clarification or challenge a request that SmartDry reasonably considers unlawful, invalid or disproportionate where there are reasonable grounds to do so;
• disclose only the minimum Customer Personal Data SmartDry reasonably believes it is legally required to disclose; and
• document the request and response in accordance with applicable legal requirements.

If SmartDry is legally prohibited from notifying the Customer, SmartDry will use reasonable efforts to obtain permission to provide notice where appropriate and lawful.

15. Return, Deletion and End of Processing

15.1 Customer choice

At the end of the relevant Services, SmartDry will, at the Customer's choice and subject to the Agreement, return or make available Customer Personal Data for export and then delete Customer Personal Data, unless applicable law requires continued storage.

15.2 Export period

The 30-day post-termination export period and the general data-exit mechanics in the Master Terms apply. The Customer should complete any required export during that period.

15.3 Active systems and backups

After the applicable export period, SmartDry may delete Customer Personal Data from active production systems. Residual copies may remain temporarily in protected backups or archives where immediate deletion is not technically practicable, provided that those copies are put beyond ordinary operational use, remain protected under this DPA and are deleted or overwritten in accordance with SmartDry's normal backup rotation, unless law requires longer retention.

15.4 Legal retention

Where SmartDry is legally required to retain Customer Personal Data after the Customer's instruction to delete or return it, SmartDry will isolate and protect the retained data and Process it only to the extent required by that law.

15.5 Customer-Specific AI Resources

To the extent a Customer-Specific AI Resource contains or encodes Customer Personal Data, that resource is subject to the deletion, non-reuse, confidentiality and retention restrictions in this DPA and the Master Terms. SmartDry is not required to export proprietary model weights, embeddings, vector indexes, learned parameters or internal AI tooling unless expressly agreed, provided this does not restrict the Customer's right to export the underlying Customer Personal Data.

16. AI-Enabled Processing and Customer-Specific AI Resources

16.1 Processor use of AI

Where the Customer enables an AI-assisted SmartDry feature and SmartDry uses Customer Personal Data to provide that feature for the Customer, such Processing is within the Customer's documented instructions and remains subject to this DPA.

16.2 Customer-Specific AI Resources

Customer-Specific AI Resources that contain, store, incorporate or encode Customer Personal Data remain Customer Personal Data for the purposes of applicable confidentiality, security, non-reuse, deletion and transfer obligations to the extent required by Applicable Data Protection Law.

16.3 Shared AI Model training

The baseline Processing instructions in this DPA do not authorise SmartDry to use identifiable Customer Personal Data to train, fine-tune, retrain or otherwise improve a Shared AI Model used for unrelated customers or third parties. Any such use requires the separate opt-in authorisation described in the Master Terms and an appropriate lawful basis under Applicable Data Protection Law.

16.4 Third-party AI providers

Where a third-party AI provider Processes Customer Personal Data on SmartDry's behalf, that provider is subject to the Subprocessor requirements in Section 11 and, where applicable, the Restricted Transfer requirements in Section 12.

16.5 Role assessment for new AI uses

If SmartDry proposes an AI Processing purpose that goes beyond the Customer's Processor instructions and for which SmartDry would determine independent purposes and essential means, SmartDry will not rely on this DPA as authority for that Processing. SmartDry will identify the applicable role, legal basis and transparency requirements before commencing that separate use.

17. SmartDry Controller Activities

This DPA does not apply to Personal Data for which SmartDry independently determines the purposes and essential means of Processing as Controller. Depending on the circumstances and applicable law, such Controller activities may include Processing reasonably necessary for:

• SmartDry account, contracting and business-contact administration;
• billing, subscription administration and financial records;
• SmartDry's own fraud prevention, abuse prevention, platform security and legal compliance;
• legal claims, corporate governance and regulatory obligations;
• SmartDry's own direct marketing where permitted by law; and
• Service Data Processing for SmartDry's own Controller purposes as expressly described in the Master Terms and applicable Privacy Notice.

Where SmartDry acts as Controller, SmartDry is independently responsible for compliance with Applicable Data Protection Law for that Processing. The fact that SmartDry acts as Controller for a limited Processing activity does not change its Processor role for separate Customer-directed Processing.

18. Liability and Remedies

This DPA forms part of the Agreement. Except to the extent Applicable Data Protection Law requires otherwise, liability arising under or in connection with this DPA is subject to the exclusions, liability caps and other risk-allocation provisions in the Master Terms, including the provisions applicable to data-protection and security claims.

Nothing in this DPA excludes or limits rights, remedies, responsibilities or liabilities that cannot lawfully be excluded or limited. A party may not recover more than once for the same loss under this DPA and another part of the Agreement.

19. Term, Survival and Changes

19.1 Term

This DPA begins when it is incorporated under Section 2.2 and continues until SmartDry no longer Processes Customer Personal Data as Processor or Subprocessor, including any period during which retained copies remain subject to this DPA.

19.2 Survival

Sections concerning confidentiality, security, Restricted Transfers, audits to the extent required by law, deletion, retained data and liability survive termination for as long as necessary to give them effect.

19.3 Changes required by law

SmartDry may update this DPA where reasonably necessary to reflect changes in Applicable Data Protection Law, regulator guidance or approved transfer mechanisms. Material changes affecting an existing Customer will be handled in accordance with the change and version-control provisions of the Master Terms. SmartDry will not use a unilateral change mechanism to materially reduce mandatory Processor protections.

20. General

20.1 Notices

Formal notices relating to this DPA will be given in accordance with the notices provisions of the Master Terms unless Applicable Data Protection Law requires another method.

20.2 Governing law

The governing law and jurisdiction provisions of the Master Terms apply to this DPA, except where mandatory transfer clauses or Applicable Data Protection Law require a different governing law, forum or Supervisory Authority for a particular Processing activity.

20.3 No reduction of statutory rights

Nothing in this DPA is intended to reduce the protections afforded to Data Subjects under Applicable Data Protection Law or the enforceable rights contained in an applicable international transfer mechanism.

Schedule 1 - Details of Processing

This Schedule records the Processing details required by Article 28. The applicable Order Form and Customer configuration may narrow the scope for a particular Customer, but do not expand Processing beyond the Agreement without documented instructions.

A. Categories of Data Subjects

• Customers and prospective customers of the Customer;
• individuals acting for the Customer's business-account customers;
• recipients, collection/delivery contacts and household or nominated contacts whose details the Customer enters;
• Customer employees, workers, managers, administrators, contractors and drivers;
• suppliers, business contacts or other individuals whose information the Customer chooses to manage using supported functionality; and
• other individuals whose Personal Data the Customer lawfully submits to the Services within the documented scope.

B. Types of Customer Personal Data

• Identity and contact data: names, customer identifiers, telephone numbers, email addresses, postal addresses and account details;
• Customer preferences and relationship data: service preferences, collection preferences, communications preferences, account status and customer notes;
• Order and transaction data: orders, service selections, garment/service items, prices, discounts, fees, taxes, order status, transaction references and payment metadata;
• Garment and inspection data: garment descriptions, brands, materials, colours, sizes, care labels, stains, defects, condition notes, garment images/videos, issue records, declared values, barcode identifiers and RFID identifiers;
• Collection, delivery and logistics data: collection/delivery addresses, route assignments, delivery instructions, timestamps, proof-of-delivery or collection records, photographs and operational location events;
• Staff and workforce data entered into the Services: names, business contact information, user roles, permissions, shift/clock activity, workflow actions, assignments and driver location data where the Customer enables location functionality;
• Communications data: Customer-directed email/SMS/message content, recipient details, delivery status, unsubscribe/suppression information, consent or soft-opt-in records where captured, feedback and communication history;
• Technical data processed on the Customer's behalf: device or session identifiers, network/IP information, audit events and logs where these form part of Customer-directed service records;
• Customer-specific AI data: prompts, Customer-provided inputs, Customer-specific outputs, embeddings, classifications, retrieval indexes or adaptations to the extent they contain or encode Customer Personal Data; and
• Other Personal Data the Customer lawfully enters into supported fields or workflows.

C. Special Categories and Criminal-Offence Data

No special-category or criminal-offence Personal Data is required as a standard category for the core SmartDry Services. Such information may be incidentally included by the Customer in free text, images or communications, or deliberately Processed only where a supported use case exists and the Customer has established the necessary legal conditions. SmartDry Processes any such Customer Personal Data solely in accordance with this DPA and documented Customer instructions.

D. Controller Rights and Obligations

The Customer retains the rights and obligations of Controller, including the right to determine lawful Processing purposes and instructions; configure authorised use; access, correct, export and delete Customer Personal Data using available functionality; receive assistance with Data Subject rights; object to new Subprocessors on reasonable data-protection grounds; receive Personal Data Breach information; and exercise audit and information rights under this DPA.

Schedule 2 - Technical and Organisational Measures

SmartDry maintains a security programme designed to protect Customer Personal Data proportionately to the risks presented by the Services. The following describes baseline categories of controls. Specific implementation details may evolve as SmartDry improves the platform, provided the overall level of protection is not materially reduced contrary to Section 7.

1. Access control and tenant isolation

• Role-based and tenant-scoped access controls designed to restrict Customer Data to authorised users and authorised SmartDry personnel.
• Logical tenant isolation, including database row-level security or equivalent tenant-scoping controls where appropriate to the relevant data store.
• Least-privilege access principles for privileged internal access and removal or adjustment of access when no longer required.
• Unique user and service identities where appropriate, with controlled administrative permissions.

2. Authentication and credential protection

• Authentication controls appropriate to the relevant SmartDry application and role.
• Protection of secrets, tokens and integration credentials using restricted configuration or secrets-management processes rather than intentional exposure in client-side code or public repositories.
• Administrative access controls designed to reduce unauthorised privileged access.

3. Encryption and network protection

• Encryption of data in transit using industry-standard transport encryption for supported network connections.
• Encryption at rest or equivalent storage protection provided by SmartDry's managed infrastructure and data-storage providers where applicable.
• Network, CDN, edge-security and traffic-protection controls appropriate to internet-facing Services.

4. Application and database security

• Type-safe and tenant-aware application boundaries designed to reduce cross-tenant data access.
• Use of UUIDs or equivalent non-sequential identifiers where appropriate to system architecture.
• Validation and authorisation controls at application and API boundaries.
• Segregation of privileged operational functions from ordinary Customer permissions where appropriate.

5. Secure development and change management

• Controlled source-code repositories and change-management practices.
• Code review, automated testing and/or CI/CD checks appropriate to the relevant component.
• Dependency and security-update management proportionate to identified risk.
• Environment and deployment controls intended to reduce unauthorised or accidental production changes.

6. Logging, monitoring and auditability

• Operational logging and audit events appropriate to authentication, administrative actions, system faults and security monitoring.
• Governed audit trails for sensitive administrative or data-management operations where supported by the relevant SmartDry module.
• Monitoring and alerting appropriate to service reliability and security events.

7. Availability, backup and recovery

• Backup and recovery controls appropriate to managed databases and production data stores.
• Processes intended to restore availability and access following material service disruption.
• Business-continuity and incident-response procedures proportionate to SmartDry's service architecture.

8. Vulnerability and incident management

• Processes for identifying, prioritising and remediating material vulnerabilities.
• Security incident triage, containment, investigation and escalation procedures.
• Post-incident remediation and control improvement where reasonably appropriate.

9. Personnel and confidentiality

• Confidentiality obligations for personnel with access to Customer Personal Data.
• Access granted according to job responsibilities and legitimate support or engineering need.
• Security and privacy awareness appropriate to personnel responsibilities.

10. Supplier and Subprocessor controls

• Due-diligence and contractual controls proportionate to the nature of a supplier's access to Customer Personal Data.
• Article 28-equivalent contractual protections for Subprocessors.
• Restricted Transfer safeguards where required.

11. Data minimisation, retention and deletion

• Product and operational practices intended to limit Processing to Customer-selected or reasonably necessary data.
• Tenant-scoped data handling and access boundaries.
• Deletion and retention processes described in Section 15, including protected backup rotation.

12. AI-specific controls where enabled

• Customer-Specific AI Resources segregated logically from shared-model training use.
• No identifiable Customer Personal Data used for Shared AI Model training under the baseline DPA instructions.
• Subprocessor and Restricted Transfer controls applied to third-party AI providers where they Process Customer Personal Data.

Schedule 3 - Subprocessor Authorisation and Register

The Customer gives the general authorisation in Section 11. SmartDry maintains the current named Subprocessor Register separately so that vendor changes can be managed without rewriting the DPA. The register is incorporated into the Customer's contracting record by reference and will identify, for each relevant Subprocessor, its name, Processing purpose and appropriate location/transfer information.

SmartDry's known platform architecture may involve infrastructure, security, communications and AI service providers. A provider is a Subprocessor only to the extent it Processes Customer Personal Data on SmartDry's behalf. A Third-Party Service selected or contracted for directly by the Customer may instead operate under its own legal terms and is not automatically a SmartDry Subprocessor.

Schedule 4 - International Transfer Terms

This Schedule applies only where a transfer of Customer Personal Data between the Customer and SmartDry is a Restricted Transfer and an appropriate safeguard is required because no applicable adequacy decision or regulation covers the transfer. It does not replace SmartDry's obligation to put appropriate safeguards in place for Restricted Transfers from SmartDry to its own Subprocessors.

A. EU GDPR transfers

Where the EU GDPR applies and the transfer from the Customer to SmartDry requires the EU SCCs, the EU SCCs are incorporated as follows, to the extent legally applicable:

• Module Two (Controller to Processor) applies where the Customer is Controller and SmartDry is Processor.
• Module Three (Processor to Processor) applies where the Customer is Processor and SmartDry is Subprocessor.
• Clause 7 (docking clause) applies.
• For Clause 9, Option 2 (general written authorisation) applies, and the notice/objection process in Section 11 satisfies the agreed change-notice procedure to the extent permitted by the SCCs.
• The processing details in Schedule 1 complete the relevant Annex I processing description.
• The technical and organisational measures in Schedule 2 complete Annex II.
• The Subprocessor information described in Schedule 3 applies to the extent required for the relevant module.
• The competent supervisory authority is determined under Clause 13 of the EU SCCs.
• Where the EU SCCs require selection of an EU Member State governing law and the parties have not specified another valid Member State in an Order Form, the law of Ireland applies, and the courts of Ireland have jurisdiction under Clause 18.

If any choice above is invalid for a particular transfer, the parties will apply the closest legally valid alternative necessary to preserve the SCCs without reducing Data Subject protections.

B. UK Restricted Transfers

Where the UK GDPR applies and a transfer from the Customer to SmartDry is a Restricted Transfer requiring an approved safeguard, the parties may use the UK IDTA or the UK Addendum as appropriate. Unless the parties expressly select the UK IDTA or another valid safeguard in writing, the UK Addendum applies where it can validly operate with the EU SCCs selected in Part A of this Schedule.

B.1 UK Addendum - Part 1 Tables

For any Restricted Transfer for which the UK Addendum applies, the parties complete Part 1 of the Approved Addendum as follows. Information incorporated from the Agreement forms part of these completed particulars.

Table 1 - Parties

Table 2 - Selected SCCs, Modules and Selected Clauses

Table 3 - Appendix Information

Table 4 - Ending this Addendum when the Approved Addendum Changes

B.2 Incorporation of Part 2 Mandatory Clauses

The parties incorporate Part 2 of the UK Addendum by reference using the ICO-prescribed Alternative Part 2 Mandatory Clauses wording:

“Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.”

For clarity, the parties intend the Part 1 information above, together with the EU SCC selections and the information in Schedules 1 to 3, to satisfy the corresponding Part 1 requirements of the Approved Addendum. The mandatory clauses are not amended except as permitted by the Approved Addendum itself.

B.3 Alternative use of the UK IDTA

If the parties expressly select the UK IDTA instead of the UK Addendum, they will complete or incorporate the then-current ICO-approved IDTA using the Processing, transfer and security information in this DPA and will not amend its mandatory clauses in a manner that reduces the approved protections or invalidates the safeguard.

C. Data protection test and supplementary measures

Where required, the party initiating the Restricted Transfer will complete the applicable data protection test, transfer risk assessment or equivalent assessment and will implement supplementary technical, contractual or organisational measures reasonably necessary to ensure the required level of protection.

D. Conflict

If an applicable approved transfer mechanism conflicts with this DPA, the mandatory terms of that transfer mechanism prevail solely to the extent necessary for the Restricted Transfer. Nothing in the Agreement modifies mandatory SCC, IDTA or UK Addendum terms in a way that would invalidate the transfer mechanism or reduce Data Subject protections.

Execution and Incorporation

This DPA is incorporated automatically into the Agreement in accordance with Section 15 of the SmartDry Master Software & Services Terms. A separate signature is not required for validity where the Customer has validly accepted the Agreement.

If the parties execute this DPA separately, electronic signatures and counterparts may be used and the signed DPA will form part of the Agreement from the date of the last signature, without limiting any earlier automatic incorporation.

SmartDry Technologies Limited | Company Number 17302780

© 2026 SmartDry Technologies Limited. All rights reserved.