Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between Known Pty Ltd trading as Kudosity (ABN 40116431700) (“Kudosity”, “we”, “our”, “us”) and the Customer (“Customer”, “you”, “your”) and is incorporated into and governed by the Agreement (defined below).

To the extent of any inconsistency between this DPA and the Agreement relating to the processing of Personal Data, this DPA prevails to the extent of that inconsistency.

This DPA applies where Kudosity processes Personal Data on behalf of the Customer in connection with the Services. Certain provisions (including those relating to international transfers and the Standard Contractual Clauses) apply only where required by applicable Data Protection Laws.

Definitions

Capitalised terms not defined in this DPA have the meanings given to them in the Terms of Service.

Purpose

Kudosity has agreed to provide the Services to the Data Controller in accordance with the terms of the Agreement. In providing the Services, Kudosity shall process Protected Data on behalf of the Data Controller.

Where the Customer acts as a Data Controller, Kudosity acts as its Data Processor. Where the Customer acts as a Data Processor on behalf of another controller, Kudosity acts as the Customer's Sub-Processor.

Scope

In providing the Services to the Customer pursuant to the terms of the Agreement, Kudosity shall process Personal Data only to the extent necessary to provide the Services in accordance with the documented instructions of the Customer (acting as Data Controller or Data Processor, as applicable), the terms of the Agreement and this DPA.

If Kudosity is required by law to process Protected Data outside of the Customer's instructions, it will inform the Customer before processing the Protected Data unless legally prohibited from doing so on grounds of public interest.

1. Processor Obligations

Kudosity may Process Protected Data in accordance with this DPA, the Agreement and the Customer's documented instructions where applicable.

Kudosity shall:

1. Promptly inform the Customer if it believes any instruction from the Customer regarding Protected Data may breach Data Protection Laws. Where permitted by law, Kudosity shall not be liable for any loss or damage resulting from processing based on such instructions after notifying the Customer.

2. Ensure that all personnel (employees, contractors, agents) with access to Protected Data:

   1. Understand the confidential nature of the data and are contractually required to maintain confidentiality;

   2. Receive appropriate data protection training; and

   3. Are subject to the obligations set out in this DPA.

3. Implement and maintain appropriate technical and organisational measures to protect Protected Data, taking into account the nature, scope, context and purposes of the Processing and the risks to Data Subjects. Such measures are described in the Security Documentation and include, where appropriate:

4. ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and Services;

5. the ability to restore the availability and access to Protected Data following an incident;

6. regular testing, assessment and evaluation of the effectiveness of technical and organisational measures.

Kudosity may update the Security Documentation and the technical and organisational measures from time to time, provided such updates do not materially reduce the overall security of the Services.

In determining the appropriate level of security, particular regard shall be had to the risks presented by the Processing, including accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Protected Data transmitted, stored or otherwise processed.

Taking into account the nature of the Processing and the information available to Kudosity, Kudosity will provide reasonable assistance to the Customer to enable it to comply with its obligations under applicable Data Protection Laws, including responding to Data Subject requests, conducting data protection impact assessments, consulting with Supervisory Authorities where required, and complying with applicable security and breach notification obligations.

Where Personal Data relating to an EU Data Subject is transferred or used outside of the EEA it shall be processed only by entities which:

1. are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or

2. have entered into Standard Contractual Clauses with Kudosity; or

3. have implemented another lawful transfer mechanism recognised under applicable Data Protection Laws, including (where applicable) the EU-U.S. Data Privacy Framework or Binding Corporate Rules.

2. Customer Obligations

The Customer represents and warrants that:

1. It shall comply with the Agreement, this DPA, and all applicable Data Protection Laws.

2. It has obtained any and all necessary permissions and authorisations to allow Kudosity, its Affiliates, and Sub-Processors to exercise their rights and fulfil their obligations under this DPA, including providing required privacy notices and obtaining valid consents from Data Subjects.

3. All instructions provided to Kudosity will be lawful and compliant with Data Protection Laws.

4. It is responsible for compliance with all applicable data protection legislation, including requirements with regard to the transfer of Personal Data under this DPA and the Agreement.

5. All subsidiaries of the Customer who use the Services shall comply with the obligations of the Controller set out in this DPA.

6. It has independently assessed that the Services are suitable for its intended processing activities and compliance obligations, and confirms that:

   1. Kudosity's processing operations meet the Customer's intended purpose for using the Services

   2. Kudosity has the necessary resources and expertise to meet its obligations under Data Protection Laws

The Customer remains solely responsible for:

1. Implementing its own appropriate technical and organisational measures to protect Personal Data, taking into account:

   1. The state of the art

   2. Implementation costs

   3. The nature, scope, context, and purposes of processing

   4. The risks to individuals' rights and freedoms

2. These measures should include, where applicable:

   1. Pseudonymisation and encryption

   2. Ensuring ongoing confidentiality, integrity, availability, and resilience of systems

   3. Timely restoration of data following an incident

   4. Regular testing and evaluation of safeguards

The Customer must ensure that any natural person acting under its authority processes Personal Data only in accordance with its instructions.

The Customer may request correction, deletion, blocking, or access to Protected Data during or after termination of the Agreement. Kudosity will comply with such requests to the extent it is permitted by law and operational feasibility.

The Customer acknowledges that some instructions, such as data return or deletion requests, may incur additional fees. Kudosity will notify the Customer of any such charges in advance.

3. Sub-Processors

The Customer grants Kudosity a general consent to engage Sub-Processors to process Personal Data on behalf of Customer, and acknowledges and agrees that Affiliates of Kudosity may be used as Sub-Processors.

Kudosity shall ensure that all Sub-Processors are bound by data protection obligations that are broadly equivalent to those set out in this DPA.

All Sub-Processors who process Protected Data in the provision of the Services to the Customer shall comply with obligations that are broadly equivalent to those set out in this DPA.

Where Sub-Processors are located outside of the EEA, Kudosity confirms that such Sub-Processors:

1. are located in a third country or territory recognised by the EU Commission to have an adequate level of protection; or

2. have entered into Standard Contractual Clauses with Kudosity or

3. have implemented another lawful transfer mechanism recognised under applicable Data Protection Laws, including (where applicable) the EU-U.S. Data Privacy Framework or Binding Corporate Rules.

Kudosity's current list of Sub-Processors (which shall include the identities of Sub-Processors and their country of location) is provided in Annex III to the SCCs in Schedule 2.

4. Liability

The limitations on liability set out in the Agreement apply to all claims made arising from or related to this DPA.

Kudosity remains responsible for any breach of this DPA caused by the acts, omissions, or negligence of its Sub-Processors, as if such acts or omissions were its own, subject to the limitations of liability in the Agreement.

The Customer shall be liable for any breaches of this DPA caused by the acts, omissions or negligence of its Sub-Processors or Affiliates, as if such acts, omissions or negligence had been committed by the Customer itself.

The Customer shall not be entitled to recover more than once for the same loss or claim under this DPA and the Agreement.

5. Audit

Kudosity shall make available to the Customer all information reasonably necessary to demonstrate compliance with its processing obligations and allow for and contribute to audits and inspections.

Where possible, compliance will be demonstrated by providing the Customer with access to the most recent third-party audit reports, certifications, or summaries prepared by an independent auditor bound by confidentiality provisions similar to those set out in the Agreement.

If, in the Customer's reasonable opinion, such documentation is not deemed sufficient, the Customer may, at its own expense conduct a more extensive audit. Any such audit must:

• Be limited to one audit per calendar year unless additional audits are reasonably required following a material security incident or to satisfy applicable Data Protection Laws;

• Be limited in scope to matters relevant to the Customer and agreed in advance with Kudosity;

• Be conducted during Kudosity's normal business hours with at least 4 weeks' prior written notice (unless a material compliance issue has been identified);

• Be conducted in a way which does not interfere with Kudosity's day-to-day business operations.

Kudosity may charge the Customer reasonable fees for time and resources required to support such an audit. Any applicable fees and the basis for calculation will be communicated in advance of any such audit.

This clause does not restrict the Customer's audit rights but clarifies the procedures applicable to audits conducted under this DPA.

6. Data Deletion

Kudosity provides functionality within the Services to enable the Customer to delete Protected Data at its discretion.

Following deletion from active systems, residual copies of Protected Data may persist in Kudosity's backup or archival systems. These backups are retained primarily to meet applicable legal and regulatory obligations (such as tax and audit requirements) and to support business continuity. Residual copies of Protected Data may remain within backup or archival systems until they are overwritten or expire in accordance with Kudosity's standard backup retention processes. Such copies remain subject to appropriate security controls and are not routinely accessed. Kudosity does not offer data restoration from backups and cannot recover deleted or partial data on the Customer's behalf.

On termination, the Customer may request the return or deletion of Protected Data. This request must be made within 14 days of termination. Kudosity will make the data available for download by the Customer in a machine-readable format.

7. Notification of Data Breach

Kudosity shall notify the Customer without undue delay after becoming aware of any accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access to any Personal Data (“Data Breach”).

Kudosity will take all commercially reasonable measures to secure the Protected Data, to limit the effects of any Data Breach and to provide reasonable assistance to the Customer in meeting the Customer's obligations under applicable Data Protection Laws.

Kudosity’s notification of, or response to, a Data Breach under this Section 7 will not be construed as an acknowledgement by Kudosity of any fault or liability with respect to the Data Breach.

Kudosity will not assess the content of the Customer’s data in order to identify information subject to any specific Customer data breach. The Customer is solely responsible for complying with data breach notification laws applicable to the Customer and fulfilling any third party notification obligations related to any Data Breach(es).

8. Compliance, Cooperation and Response

In the event that Kudosity receives a request from a Data Subject in relation to Protected Data, Kudosity will refer the Data Subject to the Customer unless otherwise prohibited by law. The Customer shall reimburse Kudosity for all costs incurred resulting from providing reasonable assistance in dealing with a Data Subject request or assisting the Customer in complying with its duties. In the event that Kudosity is legally required to respond to the Data Subject, the Customer will fully cooperate with Kudosity as applicable.

Kudosity will notify the Customer promptly of any request or complaint regarding the processing of Protected Data, which adversely impacts the Customer, unless such notification is not permitted under applicable law or a relevant court order.

Kudosity may make copies of and/or retain Protected Data to comply with its legal or regulatory requirements, including, but not limited to, retention requirements.

The parties acknowledge that it is the duty of the Customer to notify Kudosity within a reasonable time of any changes to the Data Protection Laws, codes or regulations which may affect the contractual duties of Kudosity. Kudosity shall respond within a reasonable timeframe in respect of any changes that need to be made to the terms of this DPA or to the technical and organisational measures to maintain compliance. If the parties agree that amendments are required, but Kudosity is unable to accommodate the necessary changes, the Customer may terminate the part or parts of the Services which give rise to the non-compliance. To the extent that other parts of the Services provided are not affected by such changes, the provision of those Services shall remain unaffected.

The Customer and Kudosity and, where applicable, their representatives, shall cooperate, on request, with a supervisory data protection authority in the performance of their respective obligations under this DPA.

Where a request from the Customer exceeds the assistance required under applicable Data Protection Laws or this DPA, Kudosity may charge reasonable fees for the additional work involved. Kudosity will notify the Customer of any applicable fees before undertaking the requested work.

9. Term and Termination

The terms of this DPA take effect from the start date of the Agreement and will automatically terminate upon the termination or expiry of the Agreement.

10. International Data Transfers

The Customer acknowledges and agrees that Kudosity may transfer Protected Data outside the United Kingdom ("UK"), European Economic Area ("EEA") and Switzerland, as necessary to provide the Services to a jurisdiction for which the European Commission, the UK Supervisory Authority or the Swiss Supervisory Authority has not issued an adequacy decision ("Data Transfer"), provided that Kudosity has implemented an appropriate international transfer mechanism recognised under applicable Data Protection Laws, including where applicable:

Standard Contractual Clauses

The Standard Contractual Clauses apply only to the extent required under applicable Data Protection Laws. In relation to transfers of Protected Data subject to the GDPR, Kudosity shall process Protected Data in accordance with the EU-SCCs in the form set out in Schedule 2, which are incorporated into and form a part of this DPA. The parties agree that for the purposes of the descriptions in the EU-SCCs, Kudosity is the "data importer" and Customer is the "data exporter". When a Customer is acting as a controller, the Controller-to-Processor Clauses (module 2) will apply to a Data Transfer. When Customer is acting as a processor, the Processor-to-Processor Clauses (module 3) will apply to a Data Transfer;

UK Addendum

The UK Addendum applies only to the extent required under applicable Data Protection Laws. In relation to transfers of Protected Data protected by UK GDPR, the EU-SCCs (i) apply as completed in accordance with the bullet point immediately preceding this one; and (ii) are deemed amended as specified by the UK Addendum, which is deemed executed by the parties and incorporated into and forming an integral part of this DPA as follows:

• Table 1 shall be deemed completed with the information set out in Schedule 1 to this DPA, as appropriate, the contents of which are hereby agreed by the parties;

• In Table 2, the parties select the checkbox reading: "the Approved EU-SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU-SCCs brought into effect for the purposes of this Addendum", and the accompanying table shall be deemed to be completed according to the EU-SCCs in the form set out in Schedule 2 to this DPA;

• Table 3 shall be deemed completed with the information set out in Schedule 2 to this DPA (Annexes I-III of the EU-SCCs), the contents of which are hereby agreed by the parties;

• Table 4 in Part 1 is deemed completed by selecting the checkbox reading: "neither party";

• Any conflict between the terms of the EU-SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum;

Swiss FADP

In relation to transfers of Protected Data protected by the Swiss FADP, the EU SCCs apply as completed in accordance with paragraph (a) above, except that:

• the competent supervisory authority in respect of such Protected Data shall be the Swiss Federal Data Protection and Information Commissioner;

• in Clause 17 of the EU SCCs, the governing law shall be the laws of Switzerland;

• references to "Member State(s)" in the EU SCCs shall be interpreted to refer to Switzerland, and data subjects located in Switzerland shall be entitled to exercise and enforce their rights under the EU SCCs in Switzerland; and

• references to the "General Data Protection Regulation", "Regulation 2016/679" or "GDPR" in the EU SCCs shall be understood to be references to the Swiss FADP (as amended or replaced).

11. General

This DPA sets out the entire understanding of the parties with regard to the subject matter herein.

Should a provision of this DPA be invalid or become invalid then the legal effect of the other provisions shall be unaffected. A valid provision is deemed to have been agreed which comes closest to what the parties intended commercially and shall replace the invalid provision. The same shall apply to any omissions.

This DPA shall be governed by the laws of NSW, Australia. The courts of NSW shall have exclusive jurisdiction for the settlement of all disputes arising under this DPA.

Schedule 1 - Data Processing Details

This Schedule forms part of the Customer's documented instructions to Kudosity for the processing of Protected Data.

1. Controller

The Controller is the Customer, who transfers the Protected Data described in Sections 3, 4, and 5 below in connection with the processing operations outlined in Section 6.

2. Processor

The Processor is Kudosity, which processes the Protected Data described in Sections 3, 4, and 5 below as necessary to perform the activities outlined in Section 6.

3. Categories of Data Subjects

While providing the Services, Kudosity may process Protected Data on behalf of the Customer relating to the following categories of Data Subjects:

1. Individuals whose data is uploaded to or passed through the Services by or on behalf of the Customer, including:

   1. End users, customers, clients and recipients of communications sent by or on behalf of the Customer using the Services, including individuals who receive messages or otherwise interact with services powered by Kudosity.

   2. Authorised Users of the Customer Account, including employees, contractors, or other representatives of the Customer whom the Customer has granted access to the Services under the Agreement to create, manage, or analyse messaging campaigns.

The following categories are covered by Kudosity's Privacy Policy, not this DPA:

• Kudosity's direct customers (the customer's account holders and billing contacts)

• Website visitors and analytics data subjects

• Leads and prospects contacted by Kudosity's own marketing team

• Reseller clients in white-labelled or distribution partnerships (unless their data is processed under a reseller DPA)

• Support requesters who are not customers of the customer

• Individuals interacting with Kudosity through public channels (e.g. chatbot users on Kudosity's website, including the AI Agent)

4. Categories of Data

The Protected Data may include, but is not limited to:

• Name

• Phone number

• Email address

• Custom fields or metadata uploaded by the Customer (e.g., customer ID, preferences, tags)

• Any other data uploaded to or passed through the Services by the Customer or authorised users

5. Special categories of Data

Protected Data transferred includes but is not limited to the following special categories of data:

The Services are not intended for the processing of sensitive Personal Data or Special Categories of Personal Data unless expressly agreed in writing by Kudosity and supported by appropriate technical, organisational and contractual safeguards.

6. Processing Activities

Kudosity processes Protected Data solely for the purpose of delivering the Services in accordance with the Agreement and the Customer's instructions. Processing activities may include:

• Provision of the core messaging services

• Technical support, issue diagnosis, and error resolution (limited to metadata where possible)

• Scanning for targeted threat protection and related features

The processing of Protected Data may involve operations such as collection, analysis, storage, access, consultation, and deletion, as required to perform these services effectively and securely.

7. Duration of Processing

Kudosity retains Protected Data only for as long as necessary to fulfil the purposes for which it was collected. Retention periods are based on:

• The volume, nature, and sensitivity of the data

• The potential risk of harm from misuse or unauthorised access

• Whether the original purpose can be achieved through other means (e.g. by using aggregated data instead)

• Applicable legal or regulatory requirements (e.g. tax or audit obligations)

Processing of Protected Data will cease upon termination or expiry of the relevant services, and the data will be deleted or returned in accordance with the terms of this DPA.

8. Protected Data Location

Protected Data is stored and backed up in Sydney, Australia. This applies to all customer data, including message content, metadata, and logs. Kudosity's support personnel is located in the Philippines and may access Protected Data only where reasonably necessary to provide support and technical services.

Additionally, to deliver our messaging services, we work with a range of service providers who may process personal data on our behalf to assist in providing the Services. Kudosity maintains a list of its Sub-Processors publicly available via our Trust Centre and website. Kudosity ensures that all Sub-Processors comply with stringent data protection standards to safeguard customer information.

Schedule 2 - Standard Contractual Clauses

The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection are incorporated into this DPA by reference and completed using the information contained in this Schedule.

The SCCs comprise:

Annex I - Information about the data transfer

Part A: List of parties (Data Exporter: Customer; Data Importer: Kudosity)

Part B: Description of transfer (as set out in Schedule 1 above)

Part C: Competent supervisory authority (to be determined based on Customer's location)

Annex II - Technical and Organisational Measures (Security Documentation)

The technical and organisational measures applicable to the Processing are those described in Kudosity's current Security Documentation, as updated from time to time, provided that any changes do not materially reduce the overall security of the Services. This resource is available for customers via our Security page https://kudosity.com/security. Details of the controls in place at Kudosity are also available at Kudosity’s Trust Center https://trust.kudosity.com, in accordance with Kudosity's ISO 27001 and SOC 2 compliance requirements.

Annex III - List of Sub-Processors

Kudosity's current list of Sub-Processors, including their identity, purpose and location is maintained on Kudosity’s website at https://kudosity.com/legal/sub-processors as well as on Kudosity's Trust Centre https://trust.kudosity.com. Our Trust Centre is maintained under Kudosity's ISO 27001 and SOC 2 compliance requirements and is updated to reflect the current Sub-Processors engaged by Kudosity. The Customer acknowledges that this list may be updated from time to time as Kudosity's service providers change and should refer to these resources periodically for the current list of Sub-Processors.