Data Processing Addendum

(GDPR & UK GDPR compliant)

Effective Date: October 1, 2025

Annex to: Master Subscription Agreement between Hansa Technologies OÜ (“Processor” or “HansaTech”) and Customer (“Controller”).

1. Purpose and Scope

1.1 This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement (the “Agreement”) between HansaTech and Customer.

1.2 The DPA governs HansaTech’s processing of Personal Data on behalf of Customer in connection with the provision of Mobifer SaaS services (“Services”).

1.3 The DPA applies to the extent that HansaTech processes Personal Data on behalf of Customer under EU GDPR, UK GDPR, or other equivalent data protection laws.

2. Roles and Responsibilities

• Customer acts as the Data Controller, determining the purposes and means of processing.
• HansaTech acts as the Data Processor, processing Personal Data solely on documented instructions from Customer.

3. Definitions

The following definitions apply in addition to those in the Agreement:

• “Data Protection Laws” means all applicable privacy and data protection legislation, including the EU GDPR, UK GDPR, and national implementing laws.
• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Sub-processor” means a third party engaged by HansaTech to process Personal Data on behalf of Customer.
• “Standard Contractual Clauses” or “SCCs” means the clauses approved by the European Commission (Decision 2021/914).
• “UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner’s Office (ICO).

4. Processing Instructions

4.1 HansaTech shall process Personal Data only:

• on documented instructions from Customer;
• for the purposes of providing the MobiferWL Services;
• for performance of the Agreement;
• or as otherwise required by applicable law (with prior notice, where lawful).

4.2 Customer’s initial instructions are set out in this DPA and the Agreement. Any additional or amended instructions must be agreed in writing.

5. Categories of Data and Data Subjects

Annex I (Details of Processing) describes:

• categories of Personal Data processed (e.g., driver identifiers, business contact information, device or geolocation data if applicable);
• categories of Data Subjects (e.g., Customer’s employees, contractors, and drivers using the MobiferWL platform);
• nature, purpose, and duration of processing.

6. Confidentiality

HansaTech shall ensure that all personnel authorised to process Personal Data are bound by confidentiality obligations and receive regular privacy and data protection training.

7. Security of Processing

7.1 HansaTech shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• data encryption in transit and at rest,
• access control and multi-factor authentication,
• regular security testing and vulnerability assessments,
• incident response and business continuity procedures.

7.2 These measures are described in Annex II (Technical and Organisational Measures).

7.3 HansaTech shall regularly review and update its security practices and notify Customer of material changes that reduce the overall protection level.

8. Sub-processors

8.1 Customer authorises HansaTech to engage Sub-processors as listed in Annex III (Approved Sub-processors).

8.2 HansaTech shall:

• enter into a written contract with each Sub-processor imposing data protection obligations equivalent to those in this DPA;
• remain fully liable for the Sub-processor’s acts and omissions.

8.3 HansaTech shall notify Customer at least 30 days in advance of any intended addition or replacement of a Sub-processor, allowing Customer to object on reasonable grounds relating to data protection.

9. Data Transfers

9.1 HansaTech shall process and store Personal Data primarily within the European Economic Area (EEA) or the United Kingdom.

9.2 If HansaTech transfers Personal Data outside the EEA or UK, such transfers shall comply with Data Protection Laws through one or more of the following safeguards:

• the EU Standard Contractual Clauses (Module 2: Controller → Processor),
• the UK Addendum (IDTA),
• a valid adequacy decision, or
• other lawful transfer mechanisms recognised under GDPR or UK GDPR.

9.3 Where the SCCs or IDTA apply, they are hereby incorporated by reference as if set out in full, with HansaTech as “data importer” and Customer as “data exporter”.

10. Data Subject Rights

10.1 HansaTech shall, to the extent legally permitted, assist Customer in fulfilling its obligations to respond to Data Subject requests under Articles 12–23 GDPR (e.g., access, rectification, erasure, restriction, portability, and objection).

10.2 If HansaTech receives a request directly from a Data Subject, it shall promptly forward the request to Customer without responding directly (unless legally required).

11. Assistance with Compliance

HansaTech shall assist Customer with:

• data protection impact assessments (DPIAs);
• consultations with supervisory authorities; and
• demonstrating compliance with Article 28 GDPR obligations.

Such assistance shall be at Customer’s reasonable cost if it requires significant effort.

12. Personal Data Breach

12.1 HansaTech shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer’s Personal Data.

12.2 The notification shall include:

• nature and impact of the breach,
• likely consequences,
• remedial actions taken or proposed.

12.3 HansaTech shall cooperate with Customer and take reasonable steps to mitigate the effects and prevent recurrence.

13. Return and Deletion of Data

Upon termination or expiry of the Agreement:

• HansaTech shall, at Customer’s choice, delete or return all Personal Data;
• deletion shall be performed within 30 days unless retention is required by law;
• a written confirmation of deletion will be provided upon request.

14. Audits

14.1 HansaTech shall make available all information necessary to demonstrate compliance with this DPA.

14.2 Customer (or an independent auditor mandated by Customer) may conduct audits, limited to once per year, on reasonable notice and during normal business hours, subject to confidentiality obligations.

14.3 Where an independent third-party audit or certification (e.g., ISO/IEC 27001, SOC 2) covers the relevant controls, HansaTech may rely on those reports to satisfy audit requests.

15. Liability

The parties’ liability under this DPA shall be governed by the liability clause of the Agreement.

Nothing in this DPA limits either party’s liability under Data Protection Laws.

16. Miscellaneous

16.1 In case of conflict between this DPA and the Agreement, the DPA shall prevail to the extent of the conflict regarding data protection matters.

16.2 This DPA is governed by the same law and jurisdiction as specified in the Agreement.

16.3 Electronic execution and retention are valid under eIDAS Regulation and UK Electronic Communications Act 2000.

Annex I – Details of Processing

Updated on 03.11.2025 12:46

Category	Description
Purpose of Processing	Provision of MobiferWL SaaS platform and related support services
Nature of Processing	Collection, storage, structuring, transmission, analysis, and deletion of data
Duration of Processing	For the duration of the Agreement and until deletion in accordance with Section 13
Types of Personal Data	Business contact details (name, email, phone), identifiers (user ID), operational data (route info, location data if applicable), device data, communications metadata
Categories of Data Subjects	Employees, contractors, drivers, and other authorised users of Customer
Processing Location	EEA and/or UK; with limited transfers outside the EEA/UK under SCCs/IDTA as applicable

Annex II – Technical and Organisational Measures

Updated on 03.11.2025 12:46

HansaTech implements the following key measures:

• Data encryption (AES-256 at rest, TLS 1.3 in transit)
• Access control, role-based permissions, and least-privilege principles
• Multi-factor authentication for all administrative access
• Network segmentation and firewalls
• Secure development lifecycle (code reviews, vulnerability scans)
• Continuous monitoring and intrusion detection
• Incident response policy and regular security training
• Data backup and recovery processes with encrypted off-site storage
• Logging and audit trails for access to Customer Data

Physical & Environmental Security

The HansaTech Products are hosted in Amazon Web Services (AWS). Hosting providers maintain physical & environmental security protections including:

• Physical access is restricted to approved employees based on the principle of least privilege
• Multi-factor authentication when approved personnel access facilities
• Closed Circuit Television Camera (CCTV) video recording of access points
• Fire detection and suppression systems
• Redundant infrastructure for power, networking, and cooling
• Logical Access controls

Logical access to HansaTech Products is restricted to employees based on the principle of least privilege. All access is formally approved and requires multi-factor authentication.

• Access is removed in the event of employee termination or if the employee changes roles and no longer requires access, as well as being reviewed on a quarterly basis.
• Access activity is logged in centralized logging infrastructure and protected from tampering.

Annex III – Approved Sub-processors

Updated on 03.11.2025 12:46

Name	Purpose	Location	Safeguard
Amazon Web Services (AWS)	Cloud hosting and infrastructure	Frankfurt, EU	Intra-EEA / SCCs + IDTA
Google Ireland Ltd.	Analytics and monitoring	Ireland (EEA)	Intra-EEA
Snowflake Inc	Data Cloud services for Data Analytics	Ireland (EEA)	Intra-EEA

Annex IV – Cross-Border Transfer Mechanisms

Updated on 03.11.2025 12:46

1. For EU Data:Transfers outside the EEA are governed by the EU SCCs (2021/914, Module 2), which are hereby incorporated by reference.
2. For UK Data:Transfers outside the UK are governed by the UK Addendum (IDTA), which supplements the SCCs.
3. Conflicts:If there is any inconsistency between this DPA, the SCCs, or the UK Addendum, the following order of precedence shall apply: (a) SCCs and UK Addendum; (b) DPA; (c) Agreement.