Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the Robsy Terms of Service or other written or electronic agreement between the customer identified in that agreement ("Customer") and PairOx Pty Ltd (ACN 154 477 728, ABN 82 154 477 728), an Australian proprietary limited company based in New South Wales, Australia ("PairOx", "Robsy", "we", or "us"), governing Customer's use of the Robsy platform at robsy.ai and related services (together, the "Services"). That underlying agreement, together with this DPA, is the "Agreement".

This DPA applies to the extent that PairOx Processes Personal Data on behalf of Customer in the course of providing the Services, and where such Processing is subject to Applicable Data Protection Law. Where there is a conflict between this DPA and the remainder of the Agreement on a matter of data protection, this DPA prevails (see §11).

How to read this DPA. Customer is the party that decides why and how personal data is Processed in its Robsy tenant (it is the Controller / Business). Robsy is the software provider that Processes that data on Customer's behalf and on Customer's instructions (it is the Processor / Service Provider). Robsy is a multi-tenant B2B SaaS platform: each Customer occupies an isolated tenant, and the marketplace connects tenant "providers" with tenant "customers". Robsy is an intermediary software platform and is not a party to any provider↔customer service contract and does not operate anyone's physical robots.

1. Definitions

Plain English: This section defines the key terms so the same words mean the same thing across the GDPR, UK GDPR, the CCPA/CPRA, and the Australian Privacy Act.

1.1 Capitalized terms not defined in this DPA have the meaning given in the Agreement.

1.2 "Applicable Data Protection Law" means all data protection and privacy laws and regulations applicable to a party's Processing of Personal Data under the Agreement, including as applicable: (a) GDPR — Regulation (EU) 2016/679 (the General Data Protection Regulation) and its implementing national laws; (b) UK GDPR — the GDPR as retained in United Kingdom law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018; (c) CCPA/CPRA — the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, and its implementing regulations; and (d) Australian Privacy Act — the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs") set out in Schedule 1 to that Act.

1.3 "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data (GDPR Art 4(7)). Under the Australian Privacy Act, this corresponds to the "APP entity" that holds the Personal Data and determines how it is handled. Under the CCPA/CPRA, this corresponds to a "Business".

1.4 "Processor" means a natural or legal person which Processes Personal Data on behalf of the Controller (GDPR Art 4(8)). Under the CCPA/CPRA, this corresponds to a "Service Provider".

1.5 "Sub-processor" means any third party engaged by PairOx (or by another Sub-processor) to Process Customer Personal Data on behalf of Customer in connection with the Services.

1.6 "Personal Data" means any information relating to an identified or identifiable natural person (GDPR Art 4(1)); and includes "personal information" as defined in the CCPA/CPRA and the Australian Privacy Act. As used in this DPA, "Customer Personal Data" means Personal Data contained within Customer's Robsy tenant that PairOx Processes on Customer's behalf under the Agreement.

1.7 "Processing" (and "Process", "Processed") means any operation performed on Personal Data, whether or not by automated means — such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction (GDPR Art 4(2)).

1.8 "Data Subject" means the identified or identifiable natural person to whom Personal Data relates (GDPR Art 4(1)); and includes a "consumer" under the CCPA/CPRA and an "individual" under the Australian Privacy Act.

1.9 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed (GDPR Art 4(12)). This term is read together with the "eligible data breach" concept under the Notifiable Data Breaches scheme of the Australian Privacy Act.

1.10 "Special Categories of Personal Data" means the categories of data described in GDPR Art 9 (e.g., data revealing racial or ethnic origin, political opinions, religious beliefs, health, biometric or genetic data), and "sensitive information" as defined in the Australian Privacy Act. As set out in Annex I, the Services are not intended to Process Special Categories of Personal Data.

1.11 "Standard Contractual Clauses" or "SCCs" means (a) for GDPR transfers, the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914; and (b) for UK transfers, the UK International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (the "UK Addendum").

1.12 "Sell", "Share", "Business Purpose", and "Commercial Purpose" have the meanings given in the CCPA/CPRA.

1.13 The terms "Data Protection Impact Assessment" ("DPIA"), "Supervisory Authority", and "Cross-Border Transfer" have the meanings given under Applicable Data Protection Law.

2. Roles and Scope of Processing

Plain English: Customer is in charge of the personal data in its tenant; Robsy only handles that data to run the Services and only as Customer tells it to.

2.1 Roles. As between the parties, with respect to Customer Personal Data: (a) Customer is the Controller (Business / APP entity); and (b) PairOx is the Processor (Service Provider), except where Customer acts as a Processor on behalf of a third-party controller, in which case PairOx is a Sub-processor and Customer warrants that it has the authority and instructions of the relevant controller to engage PairOx on the terms of this DPA.

2.2 Robsy's own controller data. PairOx acts as an independent Controller for a limited set of data it Processes for its own purposes — for example, account/administrative contact details, billing and subscription records, security and audit logs generated by PairOx, and product-telemetry used to operate, secure, and improve the Services. That Processing is governed by the Robsy Privacy Policy, not by this DPA. This DPA governs only PairOx's Processing of Customer Personal Data as a Processor.

2.3 Instructions. PairOx will Process Customer Personal Data only on Customer's documented instructions, including with regard to Cross-Border Transfers, unless required to do otherwise by law to which PairOx is subject; in that case, PairOx will (unless legally prohibited) inform Customer of that legal requirement before Processing. Customer's documented instructions are constituted by: (a) this DPA and the Agreement; (b) Customer's configuration and use of the Services and their features (including its tenant, RBAC, SSO, marketplace listings/bookings, workflow-automation, analytics, and integration settings); and (c) any subsequent written instructions agreed by the parties.

2.4 Lawful instructions. PairOx will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law (and may suspend performance of the affected instruction until it is amended or confirmed), without obligation to conduct a legal review of Customer's instructions.

2.5 Customer responsibilities. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data, the means by which it acquired that data, and for having a valid legal basis and any required notices/consents for the Processing that Customer instructs PairOx to perform (including the collection and use of end-user, marketplace-counterparty, and contact data). Customer must not use the Services to Process Special Categories of Personal Data except as expressly agreed in writing with appropriate additional safeguards.

2.6 Robotics / operational scope. Robsy is software. Robsy does not physically operate, supervise, or control robots, and is not responsible for robot safety, physical damage, injury, or Customer's compliance with robotics, workplace-safety, or other operational regulations, which remain Customer's responsibility. Nothing in this DPA makes PairOx a controller of, or responsible for, the underlying real-world operations that Customer manages through the Services.

3. Details of the Processing

Plain English: The specifics of what data is processed, why, for how long, and about whom are set out in Annex I.

3.1 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, the categories of Data Subjects, and the frequency of the Processing are described in Annex I (Details of Processing), which forms part of this DPA and constitutes Customer's documented instructions as to scope.

3.2 The Processing will continue for the duration of the Agreement and for so long thereafter as PairOx retains Customer Personal Data in accordance with §10.

4. Processor Obligations

Plain English: What Robsy commits to do (and not do) while handling Customer's personal data.

4.1 Process only on instructions. PairOx will Process Customer Personal Data only as set out in §2 and Annex I and will not Process it for any other purpose.

4.2 Confidentiality of personnel. PairOx will ensure that persons authorized to Process Customer Personal Data are bound by appropriate obligations of confidentiality (whether contractual or statutory), are informed of the confidential nature of the data, and access Customer Personal Data only on a need-to-know basis under least-privilege controls (see Annex II).

4.3 Security. PairOx will implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, as described in Annex II (Technical & Organizational Security Measures), taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to Data Subjects.

4.4 Assistance with Data-Subject requests. Taking into account the nature of the Processing, PairOx will assist Customer by appropriate technical and organizational measures, insofar as this is possible, to fulfil Customer's obligation to respond to requests to exercise Data-Subject rights under Applicable Data Protection Law (see §8).

4.5 Assistance with security, breach, and DPIA obligations. Taking into account the nature of Processing and the information available to PairOx, PairOx will assist Customer in ensuring compliance with its obligations relating to (a) security of Processing, (b) notification of Personal Data Breaches (see §7), (c) communication of a Personal Data Breach to Data Subjects, (d) Data Protection Impact Assessments, and (e) prior consultation with a Supervisory Authority.

4.6 CCPA/CPRA service-provider restrictions. To the extent PairOx Processes personal information subject to the CCPA/CPRA, PairOx acts as a Service Provider and certifies that it will: (a) not Sell or Share such personal information; (b) not retain, use, or disclose the personal information for any purpose other than the specific Business Purpose of performing the Services under the Agreement, or as otherwise permitted by the CCPA/CPRA; (c) not retain, use, or disclose the personal information outside the direct business relationship between the parties; (d) not combine the personal information with personal information it receives from, or on behalf of, another person, or collects from its own interaction with the consumer, except as permitted by the CCPA/CPRA; and (e) comply with applicable obligations under the CCPA/CPRA and provide the same level of privacy protection as required of a Business. PairOx will notify Customer if it determines it can no longer meet these obligations, and Customer may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use.

4.7 No independent purposes. PairOx will not Process Customer Personal Data for its own purposes as a Processor. PairOx's Processing of aggregated or de-identified data for operating, securing, and improving the Services is performed only on data that has been irreversibly de-identified/aggregated so that it no longer identifies, and cannot reasonably be linked to, any Data Subject, and PairOx will not attempt to re-identify such data.

5. Sub-processors

Plain English: Robsy uses a short, listed set of vetted third parties (like Stripe and Render). Customer authorizes them, gets notice of changes, and can object; Robsy stays responsible for them.

5.1 General authorization. Customer provides a general authorization for PairOx to engage Sub-processors to Process Customer Personal Data, subject to this §5. The Sub-processors engaged as at the effective date are listed in Annex III (Approved Sub-processors).

5.2 Flow-down of obligations. PairOx will impose on each Sub-processor, by written contract, data-protection obligations that are substantially the same as, and no less protective than, those in this DPA (including appropriate security measures), to the extent applicable to the nature of the Sub-processor's services.

5.3 Notice of changes and right to object. PairOx will maintain the list of Sub-processors in Annex III (or at a URL referenced there) and will give Customer prior notice of the addition or replacement of any Sub-processor (by email to Customer's designated contact and/or by updating the list with a mechanism to subscribe to notifications), reasonably in advance of authorizing the new Sub-processor to Process Customer Personal Data. Customer may object on reasonable data-protection grounds within thirty (30) days of notice. The parties will work in good faith to resolve the objection; if they cannot, Customer may, as its sole and exclusive remedy, terminate the affected portion of the Services in accordance with the Agreement.

5.4 Liability for Sub-processors. PairOx remains fully liable to Customer for the performance of each Sub-processor's data-protection obligations to the same extent PairOx would be liable if performing the services of that Sub-processor directly under this DPA.

6. International Transfers

Plain English: When personal data crosses borders, Robsy uses a lawful transfer mechanism — the EU Standard Contractual Clauses, plus the UK Addendum for UK transfers.

6.1 Customer authorizes PairOx and its Sub-processors to Process and transfer Customer Personal Data to, and access it from, locations outside the country in which it was collected (including outside the EEA, the United Kingdom, and Australia), as necessary to provide the Services, subject to this §6.

6.2 Where a Cross-Border Transfer of Customer Personal Data is subject to Applicable Data Protection Law that restricts such transfers, the transfer will be made subject to an appropriate safeguard or lawful transfer mechanism, being the EU Standard Contractual Clauses (Module 2, Controller-to-Processor, or Module 3, Processor-to-Processor, as applicable), together with the UK International Data Transfer Addendum for transfers subject to UK data-protection law, or an adequacy decision or other approved mechanism where one applies.

6.3 To the extent the SCCs apply, they are incorporated into this DPA by reference and completed as follows: the module, docking clause, and optional clauses are as identified in the mechanism referenced at §6.2; Annex I to this DPA populates Annex I of the SCCs; Annex II to this DPA populates Annex II of the SCCs; Annex III to this DPA populates the SCCs' Sub-processor list; the supervisory authority, governing law, and forum are as set out in the applicable transfer mechanism / §12. Where the UK Addendum applies, Tables 1–3 are completed by the corresponding Annexes of this DPA and Table 4 is completed by selecting "neither party". In the event of a conflict between the SCCs and this DPA, the SCCs prevail with respect to the transfer they govern.

6.4 For transfers subject to the Australian Privacy Act (APP 8), PairOx will take such steps as are reasonable in the circumstances to ensure that overseas recipients of Customer Personal Data handle it in a manner consistent with the APPs, including through the contractual measures in §5.2 and this §6.

7. Personal Data Breach Notification

Plain English: If Robsy suffers a breach affecting Customer's data, it will tell Customer promptly and share what it knows to help Customer meet its own reporting duties.

7.1 PairOx will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 The notification will, to the extent known and taking into account the information reasonably available to PairOx, describe: (a) the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned; (b) the likely consequences of the breach; (c) the measures taken or proposed to be taken by PairOx to address the breach and to mitigate its possible adverse effects; and (d) the name and contact details of a point of contact from whom more information can be obtained.

7.3 Where PairOx cannot provide all of this information at once, it may be provided in phases without further undue delay as it becomes available.

7.4 PairOx will reasonably cooperate with Customer and take reasonable steps as directed by Customer to assist in the investigation, mitigation, and remediation of the breach, including to support Customer's obligations under the GDPR/UK GDPR (Arts 33–34), the CCPA/CPRA, and the Notifiable Data Breaches scheme of the Australian Privacy Act.

7.5 PairOx's notification of, or response to, a Personal Data Breach under this §7 is not an acknowledgement by PairOx of any fault or liability. Customer is responsible for determining whether the breach is notifiable to any Supervisory Authority or Data Subject and for making any such notifications, except where PairOx is independently required by law to notify in its own capacity.

8. Data-Subject Requests

Plain English: If an individual contacts Robsy directly to exercise their rights, Robsy passes the request to Customer and helps Customer respond using the Services' tools.

8.1 If PairOx receives a request from a Data Subject to exercise rights under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, objection, or opt-out of Sale/Sharing) in relation to Customer Personal Data, PairOx will, unless legally prohibited, promptly forward the request to Customer and will not respond to the Data Subject directly other than to acknowledge receipt and direct them to Customer, except on Customer's instruction.

8.2 Taking into account the nature of the Processing, PairOx will provide reasonable assistance — including through the self-service functionality of the Services (e.g., tenant admin tools to search, export, correct, or delete records) and, where those tools are insufficient, through reasonable additional support — to enable Customer to respond to Data-Subject requests within the timeframes required by Applicable Data Protection Law.

8.3 To the extent Customer does not have the ability to address a Data-Subject request through the Services and requires PairOx's assistance beyond what is reasonably provided as part of the Services, PairOx may charge a reasonable fee for such additional assistance, notified in advance.

9. Audits and Information

Plain English: Robsy will make available the information Customer needs to verify compliance, and allow proportionate audits with sensible limits (to protect other tenants' security).

9.1 PairOx will make available to Customer, on request, information reasonably necessary to demonstrate compliance with the obligations in this DPA and applicable to a Processor under Applicable Data Protection Law — including, where available, current security documentation, summaries of policies and controls, penetration-test summaries, and third-party certifications or audit reports (such as SOC 2 or ISO 27001) if and when PairOx obtains them. As at the date of this DPA, PairOx holds no such certification or audit report.

9.2 PairOx will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to the following reasonable limits: (a) audits are limited to once per twelve (12) month period, unless required more frequently by a Supervisory Authority or following a Personal Data Breach affecting Customer Personal Data; (b) Customer gives at least thirty (30) days' prior written notice; (c) audits are conducted during normal business hours, without unreasonable disruption to PairOx's operations, and in a manner that does not compromise the security, confidentiality, or availability of data belonging to PairOx's other customers or to the multi-tenant platform; (d) any auditor is bound by confidentiality obligations acceptable to PairOx and may not be a competitor of PairOx; (e) where the requested assurance can reasonably be provided through the documentation in §9.1, PairOx may satisfy the audit right by making that documentation available in lieu of an on-site inspection; and (f) Customer bears its own and PairOx's reasonable costs of any audit that exceeds the documentation described in §9.1.

9.3 Because Robsy is a multi-tenant platform, no audit may include access to systems, data, or premises to the extent doing so would expose another customer's data or compromise platform security; PairOx will provide alternative evidence in such cases.

10. Return and Deletion of Personal Data

Plain English: After the Agreement ends, Customer gets a window to export its data, then Robsy deletes it (backups age out on their normal cycle).

10.1 On expiry or termination of the Agreement, or at any time on Customer's written request, PairOx will, at Customer's election, return and/or delete Customer Personal Data Processed on Customer's behalf, subject to this §10.

10.2 Export window. For a period of thirty (30) days after the effective date of termination or expiry (the "Export Window"), PairOx will make Customer Personal Data available for export through the Services' self-service export tools or another reasonable mechanism, so that Customer can retrieve its data. This cross-refers to the data-return and retention provisions of the Terms of Service and the Robsy Privacy Policy.

10.3 Deletion. After the end of the Export Window, PairOx will delete Customer Personal Data from active production systems within thirty (30) days, and residual copies held in backups will be deleted on expiry of PairOx's standard backup-rotation cycle of no more than ninety (90) days, after which they are not restored except as necessary to comply with law. Until deleted, any residual data remains protected by the security measures in Annex II and this DPA.

10.4 Legal retention. PairOx may retain Customer Personal Data to the extent, and for as long as, required by Applicable Data Protection Law or other law, in which case it will keep the data confidential, protected under Annex II, and Process it only as necessary for the required retention purpose.

10.5 On Customer's request, PairOx will certify in writing that it has completed the deletion required by this §10.

11. Liability and Precedence

Plain English: On data-protection matters this DPA wins over conflicting terms; liability is still capped as in the main Agreement.

11.1 Precedence. This DPA is incorporated into and forms part of the Agreement. In the event of a conflict between this DPA and the remainder of the Agreement, this DPA prevails with respect to its subject matter (the Processing of Customer Personal Data). Where the SCCs or UK Addendum apply, they prevail over this DPA to the extent of any conflict regarding the transfer they govern (§6.3).

11.2 Liability cap. Each party's total aggregate liability arising out of or related to this DPA — whether in contract, tort (including negligence), or otherwise — is subject to, and counts toward, the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits liability that cannot be limited or excluded under Applicable Data Protection Law or other applicable law.

11.3 Where the parties are held jointly liable to a Data Subject under the GDPR/UK GDPR, the allocation of liability between them will reflect each party's respective responsibility for the harm, consistent with GDPR Art 82.

12. Governing Law

Plain English: This DPA follows the Agreement's governing law, except where data-protection law or a transfer mechanism requires otherwise.

12.1 This DPA is governed by, and construed in accordance with, the governing law and jurisdiction set out in the Agreement (the laws of New South Wales, Australia), except: (a) to the extent Applicable Data Protection Law requires a different governing law or forum; and (b) where the SCCs or UK Addendum specify the governing law and forum for a particular Cross-Border Transfer, in which case that governing law and forum apply to the matters they govern.

12.2 This §12 does not deprive a Data Subject of any protection or forum available to them under Applicable Data Protection Law.

ANNEX I — Details of Processing

(Populates Annex I of the SCCs where the SCCs apply.)

A. Parties

B. Categories of Data Subjects

Customer determines whose data it uploads to or generates within its Robsy tenant. Typically:

• Customer's Authorized Users — the Customer's staff, administrators, and other personnel who access the Services (e.g., account/login identity, RBAC role holders, SSO-federated users).
• Customer's own customers and contacts — individuals whose data Customer manages through the Services (e.g., business contacts, end-customer records, contacts associated with fleet operations, bookings, or reporting).
• Marketplace counterparties — individuals acting for provider or customer tenants who interact through marketplace listings, bookings, messages, and transactions.

C. Categories of Personal Data

• Identity & contact data — names, business email addresses, phone numbers, job titles, organization/tenant affiliation.
• Account & authentication data — user IDs, RBAC role and permission assignments, SSO identifiers/claims, authentication and session metadata (Robsy does not store end-user passwords in plaintext; SSO/credential handling per the Agreement).
• Marketplace & transactional data — listing, booking, order, and messaging records, and marketplace-fee/transaction metadata associated with individuals. Note: payment-card primary account numbers are not stored by Robsy; card data is handled by Stripe as PCI-DSS payment processor (Robsy stores only limited billing metadata such as tokens/identifiers and status).
• Operational & telemetry data — records associating individuals with robot fleets, commands, workflow-automation, and analytics/reporting that Customer configures, to the extent such records include Personal Data.
• Usage, log & diagnostic data — audit logs of user and platform-admin actions, IP addresses, timestamps, device/browser metadata, and error/diagnostic events that may contain Personal Data.

D. Special Categories of Personal Data

None intended. The Services are not designed or intended to Process Special Categories of Personal Data (GDPR Art 9) or "sensitive information" (Australian Privacy Act). Customer must not submit such data except as expressly agreed in writing with appropriate additional safeguards (§2.5).

E. Nature and Purpose of the Processing

Processing is carried out for the sole purpose of providing, operating, securing, maintaining, and supporting the Robsy Services for Customer under the Agreement — including multi-tenant hosting and storage; user authentication (SSO) and access control (RBAC); robot fleet management and telemetry/command handling; the marketplace of robot-service providers (listings, bookings, transactions, marketplace fee handling); workflow automation; analytics and reporting; transactional email; push notifications to the Robsy mobile app; error monitoring; billing and subscription management; backup and disaster recovery; and providing customer support.

F. Duration of the Processing

For the term of the Agreement, plus the post-termination Export Window and deletion/backup-rotation periods described in §10.

G. Frequency of the Processing

Continuous, for the duration of the Agreement (Personal Data is Processed on an ongoing basis as Customer and its Authorized Users use the Services).

H. Sub-processor Processing

The subject matter, nature, and duration of Sub-processor Processing are as described in Annex III.

ANNEX II — Technical & Organizational Security Measures

(Populates Annex II of the SCCs where the SCCs apply. Measures are described at a level intended to remain accurate as the platform evolves; specific implementation details are available under §9.)

1. Encryption

• In transit: all connections to the Services are encrypted using TLS (HTTPS), and the API sends HTTP Strict Transport Security so that browsers reach it over HTTPS only.
• At rest: Customer Personal Data stored in the PostgreSQL database (Render) and object/file storage (Cloudflare R2) is encrypted at rest by the underlying platform.

2. Tenant isolation

• The platform is multi-tenant with logical isolation enforced at the data layer using PostgreSQL Row-Level Security (RLS) scoped by tenant, combined with role-based access control (RBAC) enforced in the application, so that one tenant's data is not accessible to another tenant. RBAC is enforced across the API surface (route-level authorization gates, per the platform's route manifest).

3. Access control — least privilege

• Access to Customer Personal Data is granted on a need-to-know, least-privilege basis. Authorized Users receive only the permissions assigned to their RBAC roles. Administrative/production access by PairOx personnel is restricted, individually authenticated, and limited to what is required to operate and support the Services.
• Support for SSO and enforcement of authentication controls, including authenticator-app multi-factor sign-in (TOTP) for Robsy accounts; PairOx protects its administrative access to the hosting, database, payment, and storage provider consoles that run the Services with multi-factor authentication (MFA).

4. Audit logging

• The platform records audit logs of platform-admin and privileged actions, and of security-relevant user actions, with timestamps and actor identity, to support monitoring, investigation, and accountability. Access to logs is restricted to authorized users of the relevant tenant and to PairOx personnel who operate the Services.

5. Secrets management

• Application secrets, API keys, and credentials are stored in the hosting provider's environment configuration (Render environment groups), never in source code, with access restricted to PairOx personnel who operate the Services, and are rotated when a compromise is suspected.

6. Backups and resilience

• Customer Personal Data is backed up to support recovery: the production PostgreSQL database runs on a managed plan with the provider's automated backups, backups are subject to the rotation cycle in §10.3, and a documented restore procedure is maintained and has been tested end to end.

7. Vulnerability and patch management

• PairOx maintains processes for dependency and platform patching, vulnerability identification, and remediation, and uses error monitoring/diagnostics (Sentry) to detect and triage operational and security-relevant issues.

8. Incident response

• PairOx maintains an incident-response process covering detection, triage, containment, eradication, recovery, and post-incident review, including the Personal Data Breach notification duties in §7.

9. Personnel — confidentiality and training

• PairOx personnel with access to Customer Personal Data are bound by confidentiality obligations, are granted access on a least-privilege basis, and receive security/privacy awareness guidance appropriate to their role.

10. Change management and secure development

• Code changes are subject to automated tests before release; the CI pipeline runs linting and type-checking on pull requests; security-relevant changes are reviewed; and production deployments are started deliberately, never automatically on every code change.

11. Data segregation of environments

• Production Customer Personal Data is segregated from development/test environments; production data is not used in non-production environments except where de-identified or expressly authorized.

ANNEX III — Approved Sub-processors

(Populates the Sub-processor list for the SCCs where they apply. PairOx will keep this list current and give notice of changes per §5.3.)

End of Data Processing Addendum (Version 1.1).