DPA schedules and annexes

S1Standard Contractual Clauses

The parties incorporate by reference the Standard Contractual Clauses (Module Two: Controller to Processor) pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The full text of the SCCs is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. The SCCs are completed as follows:

• Clause 7 (Docking Clause) does not apply.
• Clause 9 (Use of Sub-processors): Option 2 (general written authorization) applies. The minimum notice period for Sub-processor changes is thirty (30) days.
• Clause 11 (Redress): The optional language does not apply.
• Clause 17 (Option 1): The SCCs are governed by the laws of Ireland.
• Clause 18(b): Disputes shall be resolved before the courts of Ireland.
• Annex I: As set out in Annex 1 to this Schedule 1.
• Annex II: As set out in Annex 3 to this Schedule 1.
• Annex III (Sub-processor list): As set out in Annex 4 to this DPA.

The parties agree that by executing this DPA, they are deemed to have executed the SCCs with effect from the Effective Date, with Customer as the data exporter and Axle Tech as the data importer.

S2UK International Data Transfer Addendum

The parties agree to and incorporate by reference the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (Version B1.0), available at ico.org.uk ("UK Addendum"), completed as follows: Table 1 using the party information in Annex 1; Table 2 using the SCCs incorporated under Schedule 1; Table 3 using the party information from Annex 1 and the processing details from Annex 2; Table 4: neither party may terminate the UK Addendum pursuant to Section 19 thereof. The parties shall cooperate in good faith to update this DPA if the ICO issues a revised Approved Addendum.

A1List of parties

Data exporter

The Customer, as identified in the Agreement. Contact: Customer's designated privacy or data protection contact, as set out in the Agreement and/or Customer's Axle Tech account profile. Role: Controller (or Processor on behalf of Controller where Customer acts as a processor).

Data importer

Axle Tech, Inc. Address: 15 W 18th St, Floor 9, New York, NY 10011, United States. Contact: contact@axleaccess.com. Role: Processor (or Sub-processor where Customer acts as Processor).

A2Details of data processing

A3Technical and organizational security measures

The following measures are maintained by Axle Tech in accordance with Clause 8.6 of the SCCs. See also Exhibit 1 (AI/ML Usage Controls Policy), available to Customer upon written request to contact@axleaccess.com.

• Encryption in Transit: All Customer Personal Data transmitted via cloud Services is encrypted in transit using TLS 1.2 or higher. HTTPS is enforced across all Service endpoints.
• Encryption at Rest: Customer Personal Data stored within Axle Tech Cloud is encrypted at rest using AES-256 or equivalent. Axle Tech encrypts Customer Data at rest using AWS Key Management Service. Sensitive information such as database credentials are stored in AWS Secrets Manager.
• Access Controls: Role-based access control (RBAC) is applied to all internal systems processing Customer Data. Multi-factor authentication (MFA) is required for privileged administrative access. Principle of least privilege is enforced. Access rights are reviewed at least annually and revoked promptly upon personnel offboarding.
• Network Security: Production environments are logically segregated from development and testing environments. Firewalls and intrusion detection/prevention systems are maintained. Vulnerability scanning and patch management are conducted on a regular schedule.
• Physical Security: Cloud Services are hosted in AWS data centers holding ISO 27001 and/or SOC 2 certifications. Physical security of data centers is managed by the hosting provider.
• Incident Response: Axle Tech maintains a documented security incident response plan. Customer notification within 72 hours of discovery of a Security Incident. Post-incident review conducted following any material incident.
• Business Continuity and Backup: Multi-region disaster recovery using active-passive architecture across AWS US-East-1 (primary) and US-West-2 (secondary) with automated fail-over. Automated backups performed on a continuous basis. Documented recovery targets: RTO 1–2 minutes, RPO near-zero (less than 1 second) for the database replication layer.
• Personnel Security: Data protection training conducted for all personnel with access to Customer Data. Written confidentiality obligations apply to all employees and contractors.
• Sub-processor Management: Written data processing agreements maintained with all Sub-processors. Due diligence conducted before engagement and periodically thereafter. Customer will receive at least thirty (30) days' prior notice of any Sub-processor changes.
• AI/ML Usage Controls: Axle Tech does not use Customer Data to train, fine-tune, or improve any AI/ML models, whether internal or third-party. AI/ML systems operate solely on data required for real-time functionality and outputs, and Customer Data is never retained for model training purposes. All AI/ML systems require CTO and CIO approval prior to production deployment. AI outputs are treated as Customer Data and are not shared with or used for the benefit of other customers. Axle Tech does not perform facial recognition or biometric processing on Customer-uploaded content.
• Certifications: Axle Tech maintains SOC 2 Type II and ISO 27001 certifications. Penetration testing conducted at least annually on systems that handle Customer Data. Summary of results available upon written request subject to confidentiality agreements.
• GDPR: Axle Tech acknowledges that it is in the process of formalizing its compliance with GDPR and commits to finalizing within ninety (90) days of the Effective Date of this DPA.

A4Sub-processors

The following Sub-processors are approved by Customer as of the Effective Date. Axle Tech shall maintain and update this list and provide at least thirty (30) days' prior written notice to Customer before adding or replacing any Sub-processor, in accordance with Section 5.5 of this DPA.

Last updated: March 19, 2026

All Sub-processors located outside the EEA or UK are subject to appropriate transfer mechanisms (Standard Contractual Clauses or adequacy decision) as indicated above. Sub-processor details are provided to Customer upon written request to contact@axleaccess.com.

A5CCPA / CPRA service provider terms

This Annex 5 applies to the extent the CCPA/CPRA applies to the Processing of Customer Personal Data under the Agreement.

A5.1 Service Provider Relationship. The parties acknowledge and agree that Axle Tech is a "service provider" as defined in the CCPA/CPRA and receives Customer Personal Data from Customer solely to provide the Services, which constitutes a limited and specified business purpose. Axle Tech will not "sell" or "share" any Customer Personal Data as those terms are defined in the CCPA/CPRA.

A5.2 Restrictions. Axle Tech will not retain, use, or disclose any Customer Personal Data provided by Customer under the Agreement except: (a) as necessary for the specific business purpose of providing the Services; (b) as stated in the Agreement or this DPA; (c) as permitted by the CCPA/CPRA; or (d) as otherwise agreed in writing by the parties. Axle Tech certifies that it understands these restrictions and will comply with all CCPA/CPRA obligations imposed on service providers.

A5.3 Notification. Axle Tech will notify Customer if it determines that it can no longer meet its obligations as a service provider under the CCPA/CPRA.

A5.4 Consumer Rights Assistance. Axle Tech shall, upon Customer's written instruction, assist Customer in responding to verifiable consumer requests regarding Customer Personal Data Processed by Axle Tech, including requests to know, delete, correct, or opt out of sale or sharing, to the extent technically feasible.

A5.5 Sub-processor Compliance. Axle Tech shall ensure that any Sub-processor engaged to Process Customer Personal Data on its behalf is also a "service provider" or "contractor" as defined in the CCPA/CPRA and is subject to restrictions no less protective than those in this Annex 5.

E1AI/ML usage controls policy

1. Leadership Oversight. All AI/ML systems must be reviewed and approved by the CTO and CIO prior to production deployment. Compliance team must be consulted to ensure contractual and regulatory alignment. Any updates to AI/ML systems require re-approval before release.

2. Data Management and Access. Classify and review all data used in AI/ML systems to confirm privacy and confidentiality standards. Restrict access to AI/ML models, training data, and production environments to authorized personnel. Enforce role-based permissions and maintain audit logs of all AI/ML-related system access. Client data is not used to train, fine-tune, or improve any AI/ML models, whether internal or third-party. AI/ML systems operate solely on data required for real-time functionality and outputs, and client data is never retained for model training purposes.

3. Risk and Compliance Alignment. Validate that all AI/ML use cases are explicitly permitted within customer contracts. Benchmark AI/ML systems against industry best practices and recognized frameworks. Perform risk assessments prior to production release.

4. Documentation and Transparency. Maintain documentation for each AI/ML system, including: purpose and intended use, data sources, model design and assumptions, and risk considerations.

5. Monitoring and Review. Continuously monitor AI/ML systems for anomalies, unexpected outputs, or performance issues. Log and review system activity to identify potential security or operational concerns. Conduct annual policy reviews by senior leadership and update based on evolving standards.

6. Continuous Improvement. Regularly evaluate AI/ML governance against updated industry standards and regulatory guidance. Incorporate lessons learned from monitoring and audits into future AI/ML projects. Ensure ongoing training for staff involved in AI/ML development and oversight.

Review and Updates. This policy will be reviewed annually, or upon significant system or regulatory changes, to ensure continued effectiveness and alignment with Axle's risk management framework.