Data Processing Addendum

1.1 This Data Processing Addendum (DPA) is between STRAPIVO LTD, a Cyprus limited liability company, registration number HE 492139, with registered office at 28 Georgiou Kalogeropoulou, Flat/Office 101, Mesa Geitonia, 4007 Limassol, Cyprus (STRAPIVO), and the business customer identified as the client in the written services agreement incorporating this DPA (Client). That agreement, including its order or engagement documents, is the Agreement. The services supplied under it, including bespoke setup, onboarding, the strategic intelligence platform and support, are the Services.

1.2 This DPA governs personal data in Client Data that STRAPIVO processes on the Client's behalf in providing the Services (Client Personal Data). Client Data includes materials supplied for the engagement, workspace content, conversations, stored strategic memory and outputs generated specifically for the Client, as defined more fully in the Agreement. Information derived from Client Personal Data remains within this DPA when it is personal data.

1.3 The Client is controller and STRAPIVO is processor for Client Personal Data. The Client determines the purposes and essential means of processing. STRAPIVO may determine practical technical means within the Client's documented instructions and this DPA. This DPA does not authorise STRAPIVO or an AI provider to use Client Personal Data for independent purposes. A different role is not created merely by describing a supplier as a processor; any genuinely separate controller processing must have its own lawful basis and transparency arrangements and must respect the Agreement's restrictions on Client Data.

1.4 Data Protection Law means Regulation (EU) 2016/679 (GDPR) and applicable Cyprus and other applicable EU or EEA Member State laws governing the processing covered by this DPA. Personal data, processing, controller, processor, supervisory authority and personal data breach have the meanings given in the GDPR. A Subprocessor is another processor engaged by STRAPIVO, directly or through another Subprocessor, to process Client Personal Data on the Client's behalf.

1.5 This DPA and its completed schedules form part of the Agreement when expressly incorporated into an agreement binding on both parties. The applicable version is the version identified in that Agreement or, if no version is specified, the version supplied to the Client and available at the identified DPA address on the date the Agreement is concluded. STRAPIVO will retain that version and make it available to the Client. A later website posting does not replace the agreed version or retroactively supply missing terms. If no DPA was available when an existing agreement was concluded, the parties must expressly agree the DPA in accordance with that agreement's amendment requirements before relying on it.

1.6 This DPA prevails over inconsistent provisions of the Agreement concerning the processing of personal data. Mandatory provisions of applicable transfer instruments prevail over both to the extent of a conflict. Other provisions of the Agreement remain applicable. Changes to this DPA require the amendment procedure in the Agreement; operational updates expressly permitted by clauses 4.3 and 5 do not permit new processing purposes or a reduction of the agreed protection.

1.7 This DPA applies for the duration of the relevant processing, including the export, return, deletion and restricted retention periods after the Services end. Duties intended to protect data or establish accountability continue for as long as relevant data or required compliance records are retained.

2.1 The Agreement, this DPA, the completed schedules, and the Client's authorised use and configuration of the Services are the Client's initial documented instructions. These instruct STRAPIVO to carry out the processing described in Schedule 1 solely to provide the Services. Additional instructions may be given in writing, including by email, by the Client's designated contacts. STRAPIVO will keep a record of material instructions. An instruction that changes the agreed service scope may require a written variation of scope or charges, but this does not excuse compliance with Data Protection Law.

2.2 STRAPIVO will process Client Personal Data only on those documented instructions, including as to international transfers, unless Union or Member State law to which STRAPIVO is subject requires otherwise. In that case STRAPIVO will inform the Client of the legal requirement before processing unless that law prohibits notification on important grounds of public interest. A third-country demand is not, merely by its existence, an exception to the Client's instructions; clause 6 applies.

2.3 STRAPIVO will immediately inform the Client if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. It will suspend the affected processing while the parties clarify or correct the instruction where necessary to avoid unlawful processing. STRAPIVO will promptly notify the Client if it cannot comply with this DPA. The parties will cooperate on a lawful alternative; neither is required to carry out unlawful processing.

2.4 The Client is responsible for the lawfulness, fairness and transparency of its collection and use of Client Personal Data, including an appropriate legal basis, required notices, accuracy, relevance, retention instructions and lawful disclosure to STRAPIVO. The Client will limit personal data supplied to what is necessary for its use of the Services, manage its authorised users and credentials, and identify any processing requiring additional safeguards. These responsibilities do not displace STRAPIVO's own obligations under this DPA or Data Protection Law.

2.5 The Services are intended for business strategy work, not as a repository for special-category data, criminal-conviction or offence data, or children's data. The Client will not intentionally submit such data unless the parties first document the need, lawful instructions and suitable additional safeguards in Schedule 1. If STRAPIVO becomes aware of such data outside the agreed scope, it will notify the Client and assist with restriction, removal or a lawful agreed arrangement. Incidental submission does not remove that data from the protections of this DPA.

2.6 STRAPIVO will not use Client Data to train, retrain or fine-tune AI models shared with other customers, or authorise a third-party AI provider to do so. STRAPIVO will use third-party AI services only under contractual terms prohibiting that use and will maintain the settings needed to give effect to the restriction. It will exercise reasonable skill and care in selecting and configuring those services. Maintaining the Client's strategic memory and generating responses for the Client are permitted within the agreed instructions. If STRAPIVO becomes aware of a provider's failure to honour these restrictions, it will promptly take reasonable steps to stop the affected processing, mitigate the consequences and notify the Client, without limiting its other obligations under this DPA.

3.1 STRAPIVO will restrict access to Client Personal Data to persons who need access for the instructed processing. It will ensure that authorised persons are bound by contractual confidentiality commitments or an appropriate statutory duty of confidentiality, receive instructions relevant to their role, and process the data only as authorised.

3.2 Confidentiality duties covering Client Personal Data continue after a person's access or engagement ends and for as long as the data remains personal data. The Agreement's general confidentiality expiry does not shorten these duties. STRAPIVO will apply access revocation procedures when access is no longer required.

4.1 STRAPIVO will implement and maintain appropriate technical and organisational measures as required by Article 32 GDPR, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to individuals. This includes considering confidentiality, integrity, availability, resilience, recovery and evaluation of effectiveness, and encryption and pseudonymisation where appropriate.

4.2 The agreed measures and their implementation details are set out in Schedule 2. STRAPIVO will maintain a documented security responsibility structure and assess material changes to the Services for their impact on Client Personal Data. It will use the results of security reviews, incidents and identified vulnerabilities to prioritise corrective action.

4.3 STRAPIVO may update the technical implementation of the measures to address evolving risks or technology, provided the updates do not materially reduce the protection of Client Personal Data or depart from an express contractual commitment. It will document material changes and provide the Client with updated relevant information. Any change requiring a new Subprocessor, new transfer or materially different processing remains subject to the relevant provisions of this DPA.

5.1 By agreeing this DPA with a completed Schedule 3, the Client gives general written authorisation for the Subprocessors identified there to perform the specified activities, and for additions or replacements made under this clause. This is not authorisation to use unidentified providers. STRAPIVO will make an accurate register available to the Client, identifying the relevant legal entities throughout the processing chain, their addresses and data protection contacts, services, data access, locations and transfer arrangements. It will identify which providers may receive that Client's data, including alternative AI providers that can be selected or used in fallback routing.

5.2 STRAPIVO will specifically notify the Client's designated contact in writing at least 30 calendar days before an intended addition or replacement begins processing Client Personal Data. The notice will contain the relevant Schedule 3 information and sufficient information about safeguards to assess the proposal. A website change alone is insufficient notice. The Client may object on reasonable data protection grounds within 15 calendar days after receipt of a complete notice, identifying its concerns. An incomplete notice does not start the objection period.

5.3 The parties will work in good faith to resolve an objection, for example through further safeguards, a different provider or disabling the affected feature. STRAPIVO will not send the Client's data to the proposed provider while a timely objection remains unresolved. If no lawful and reasonably practicable solution is available, either party may terminate the affected Services on written notice before the proposed provider is used; where the affected Services cannot reasonably be separated, the relevant engagement may be terminated. Return and deletion follow clause 10; financial consequences remain governed by the Agreement and applicable law. Silence after a complete notice and the objection period permits the change under the existing general authorisation, but does not excuse any other obligation in this DPA. An urgent change requires specific written authorisation if the notice timetable cannot be met; otherwise the affected processing must be paused or handled by an already authorised provider.

5.4 Before a Subprocessor receives Client Personal Data, STRAPIVO will assess whether it provides sufficient guarantees and enter into a binding written contract imposing the same data protection obligations as this DPA insofar as applicable to the delegated processing. These include appropriate security, purpose and training restrictions, confidentiality, incident and rights assistance, deletion, audit information, restrictions on further delegation and lawful transfers. STRAPIVO will ensure equivalent requirements are passed through the processing chain and maintain evidence of its assessment and contracts.

5.5 STRAPIVO remains fully liable to the Client for the performance of its Subprocessors' data protection obligations under Article 28(4) GDPR. Client authorisation does not transfer that responsibility to the Client or restrict the Client to pursuing the provider. STRAPIVO will provide information necessary for the Client to assess the chain's guarantees and, where necessary to demonstrate compliance, relevant contractual terms, subject to proportionate protection of unrelated confidential information.

6.1 The parties will record storage, backup and processing locations, including locations from which personnel or providers may access data, in Schedules 1 and 3. Any EU hosting commitment in the Agreement remains binding according to its terms. This DPA does not authorise processing contrary to a stricter location commitment in the Agreement; any needed clarification or change must be expressly agreed before the affected processing.

6.2 STRAPIVO will transfer Client Personal Data outside the EEA, including by making it available to a separate recipient there, only within the Client's documented instructions, the agreed location restrictions and Chapter V GDPR. The same requirements apply to onward transfers. STRAPIVO will identify the actual recipient, destination and applicable transfer mechanism before the transfer and provide relevant supporting information to the Client.

6.3 A transfer may rely on an applicable European Commission adequacy decision only while the recipient and processing fall within its scope. Otherwise STRAPIVO will establish valid Article 46 safeguards before the transfer, such as the applicable European Commission standard contractual clauses (SCCs), complete the relevant annexes and options, assess the destination's laws and practices where required, and implement necessary supplementary measures. Where STRAPIVO is exporter to a Subprocessor, it will enter into the instrument with that recipient and complete the required assessment before the transfer.

6.4 STRAPIVO will monitor material changes affecting the transfer safeguards, inform the Client if it can no longer comply, and suspend affected transfers unless and until lawful safeguards are restored. It will provide relevant transfer documentation to enable the Client to fulfil its accountability obligations, with proportionate confidentiality protections. Any SCCs actually entered into retain their own mandatory rights, liability, suspension and termination provisions.

6.5 STRAPIVO will assess governmental requests for Client Personal Data, notify the Client where legally permitted, and disclose only what is lawfully required. It will comply with Article 48 GDPR and applicable transfer safeguards, including duties to assess and, where required, challenge requests, seek permission to notify, and document its response. Nothing here provides blanket consent to foreign-government access.

7.1 Taking account of the nature of processing, STRAPIVO will assist the Client through appropriate technical and organisational measures, insofar as possible, with requests to exercise rights under Chapter III GDPR. This includes locating relevant data, providing accessible copies, and implementing the Client's lawful instructions to correct, restrict, export or erase data, including relevant stored memory and derived records where personal data persists.

7.2 STRAPIVO will promptly forward a request received directly from a data subject that concerns Client Personal Data to the Client's designated contact. It will not substantively decide the request without the Client's instruction unless legally required. It may acknowledge receipt and direct the individual to the Client. The Client is responsible for verifying identity and determining the response. STRAPIVO will provide its assistance sufficiently promptly to enable the Client to meet applicable deadlines, and will tell the Client promptly of any impediment.

7.3 Taking account of the nature of processing and the information available to it, STRAPIVO will assist the Client with compliance with Articles 32–36 GDPR. This includes relevant information about security, processing and transfers for risk assessments and data protection impact assessments; support for prior consultation with a supervisory authority where necessary; and the breach assistance in clause 8. STRAPIVO will maintain the processing records required of it by Article 30 and cooperate with competent supervisory authorities as required by law.

7.4 Ordinary assistance under this DPA is included in the Services. The parties may agree in advance reasonable charges for exceptional, clearly defined assistance beyond ordinary support, excluding work needed to remedy STRAPIVO's or its Subprocessors' failure to meet their obligations. A fee discussion or dispute will not delay legally required assistance or prevent the Client from exercising its rights under this DPA.

8.1 STRAPIVO will notify the Client without undue delay after becoming aware of a personal data breach affecting Client Personal Data. Notification is not conditional on STRAPIVO deciding that the breach creates a reportable risk to individuals. STRAPIVO will not wait for a complete investigation before notifying.

8.2 STRAPIVO will send the information then available to the Client's designated incident contact. This will describe the incident, affected systems and data, categories and approximate numbers of affected individuals and records where possible, likely consequences, measures taken or proposed to contain and remedy it, and a contact for further information. It will provide missing information in phases without undue further delay and keep the Client informed of material developments.

8.3 STRAPIVO will investigate, take appropriate containment and remedial measures, preserve relevant evidence and incident records, and cooperate with the Client in assessing consequences and making any required notifications. The Client determines notifications to authorities and individuals concerning its controller processing; STRAPIVO will not make them on the Client's behalf without instruction unless legally required, in which case it will inform the Client where permitted. Each party remains responsible for its own statutory obligations. Notification under this clause is not by itself an admission of liability.

9.1 STRAPIVO will make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA and will allow for and contribute to audits, including inspections, by the Client or an independent auditor mandated by it. STRAPIVO may first provide relevant documentation, answers and available independent assurance reports; these do not replace an audit where further verification is reasonably necessary.

9.2 Routine audits will be arranged on reasonable advance notice, with scope, timing and security arrangements proportionate to the processing and concern. The parties will seek to avoid unnecessary disruption and protect other customers' data and confidential information. Auditors may be required to undertake appropriate confidentiality commitments. These arrangements must not frustrate effective verification, urgent investigation following a breach, justified concerns about non-compliance, or supervisory authority requirements. There is no absolute annual audit limit.

9.3 STRAPIVO will provide relevant findings and a reasonable remediation plan for identified deficiencies. Access to a Subprocessor's information or premises will be coordinated through STRAPIVO and its contractual rights without diminishing STRAPIVO's obligations to demonstrate compliance and ensure sufficient guarantees. No confidentiality or cost arrangement may prevent disclosure to a competent supervisory authority or render the Client's audit right ineffective. Each party bears its ordinary internal cooperation costs; the Client ordinarily bears its external auditor's fees, without prejudice to remedies under the Agreement and law.

10.1 During the Services STRAPIVO will implement the Client's lawful return, restriction and deletion instructions, subject to any retention required by Union or Member State law. The Client may use available service controls or request assistance through the designated contact. Retention and erasure must cover relevant source materials, conversations, outputs, strategic memory, indexes, logs and provider-held copies to the extent they contain Client Personal Data.

10.2 On expiry or termination, the Client may export Client Data in a commonly usable format for up to 30 calendar days, as provided by the Agreement. During that period STRAPIVO will retain Client Personal Data only as needed for secure export, return, deletion and required protection, and will stop ordinary service processing. An earlier express deletion instruction takes precedence for the data identified; STRAPIVO will explain any resulting loss of export availability before implementing it where practicable.

10.3 The Client may choose return or deletion by written instruction during that period. At the Client's choice STRAPIVO will return all Client Personal Data within scope and then delete existing copies, or delete it without return. The standard return method is a secure export in the commonly usable format identified in Schedule 1, with assistance where service controls cannot return data within scope. If the Client gives no alternative instruction, it instructs STRAPIVO to begin deletion after the 30-day export window. Return does not permit indefinite retention of STRAPIVO's copies.

10.4 STRAPIVO will complete deletion from active systems and require deletion from Subprocessors without undue delay, within the confirmed deadlines in Schedule 1. Backups that cannot practicably be selectively erased will be isolated from ordinary use, remain subject to this DPA, and expire under the fixed maximum backup cycle stated in Schedule 1. If a backup is restored for recovery before expiry, applicable deletion instructions will be reapplied before data returns to ordinary use. Backup retention must not be used as a general exception to deletion.

10.5 If Union or Member State law requires retention, STRAPIVO will identify the legal requirement, affected categories and duration to the Client unless legally prohibited; retain only the required data, restrict its processing to that legal purpose and necessary protection, and delete it when the requirement ends. STRAPIVO will confirm completion of return/deletion on request and identify any limited retained copies, their basis and scheduled destruction. All continuing copies remain protected by this DPA.

11.1 To the extent legally permitted, the Agreement's exclusions and aggregate limitation of liability apply to claims between the parties under this DPA as part of the same aggregate limit, not as a separate additional cap. No new indemnity is created by this DPA.

11.2 Nothing in the Agreement or this DPA limits STRAPIVO's responsibility under Article 28(4) for the performance of its Subprocessors' obligations, a data subject's rights or compensation under Article 82, supervisory authority powers or administrative sanctions, mandatory rights under applicable transfer instruments, or any liability or statutory recourse that cannot lawfully be limited. Commercial allocation between the parties does not excuse performance of statutory processing obligations.

11.3 The Client may require suspension of processing that infringes this DPA until compliance is restored. The parties will cooperate to limit suspension to affected processing where practicable. Termination and remedies otherwise follow the Agreement, subject to clause 5.3, mandatory law and applicable transfer instruments. The Agreement's cure period does not authorise continued unlawful processing while a breach is being remedied. Export, return and deletion remain governed by clause 10 where the relevant Services end.

11.4 Notices use the contacts in Schedule 1 and the Agreement. Incident notices and time-sensitive rights communications must be sent promptly to the designated operational contacts; a contractual deemed-receipt rule does not extend a statutory deadline or justify delayed delivery. Each party will maintain current contacts and notify changes.

11.5 The Agreement's governing law and dispute provisions apply to this DPA, without limiting mandatory supervisory authority jurisdiction, data subject remedies or the law and forum provisions of any applicable SCCs.

B. Subject matter and purpose
Processing necessary to deliver the Client's bespoke strategic setup, onboarding, Strategic Design System workspace, strategy-room conversations, strategic memory, market-signal monitoring and related support under the Agreement. The purpose is the Client's business strategy work and provision, operation and security of those Services on its behalf. This is not an instruction to train shared AI models, advertise using Client Personal Data, sell it, or build unrelated cross-client profiles.

F. Frequency and duration
Processing is recurring throughout the engagement as the Client and users interact with the Services and as agreed monitoring operates. Storage continues for the service term subject to earlier Client instructions, followed by the 30-day export period and restricted deletion/retention periods in clause 10. No automatic extension of the service term results.

Required fields for EVERY actual entity:
• Legal name, registered/business address and data protection contact (name/role and contact details).
• Direct or downstream engagement; identity of the engaging provider.
• Product/service, specific processing purpose and responsibilities.
• Categories of Client Personal Data and affected users/features; optional, default or fallback use.
• Storage, processing, backup and personnel-access countries/regions.
• Retention, deletion timing, human review and any restricted-purpose logs.
• Written Article 28 terms and evidence of sufficient security guarantees.
• For AI services, contractual shared-training prohibition and required account/settings evidence.
• Transfer destination and mechanism; relevant adequacy scope or executed safeguard, module/annex completion, assessment and supplementary measures where required.
• Date first authorised, date notified, effective date, and version of the entry.