Data Processing Addendum.

Roles. The Customer is the Controller of Customer Personal Data and Bynn is its Processor. Where the Customer acts as a Processor on behalf of a third-party Controller, Bynn is the Customer's Sub-processor, and the Customer warrants that its Instructions and its engagement of Bynn have been authorised by that Controller.

Bynn as Controller. Bynn processes the following as a Controller, as Section 1.1 of the Privacy Policy describes, and this DPA does not apply to that processing: account and billing data, records of the use of the Services, communications with Bynn, and data collected through the Website and the Product Websites.

ZOREAL Services. The ZOREAL Services are governed by the ZOREAL Product Terms, as Section 3.3 of the Terms of Use provides. Where those Product Terms, or a data processing agreement signed for the ZOREAL Services, set out terms for the processing of Personal Data in them, those terms govern it; to the extent they do not, this DPA applies to that processing as well.

The Customer's responsibility for its data. The Customer is responsible for the accuracy, quality and lawfulness of Customer Personal Data and of the means by which it obtained it, and for having a lawful basis for every processing it instructs.

Processing on Instructions. Bynn shall process Customer Personal Data only on the Customer's documented Instructions, including with regard to transfers, unless the law to which Bynn is subject requires otherwise, in which case Bynn shall inform the Customer of that legal requirement before processing unless the law prohibits it. The Agreement, the Customer's configuration of the Services, including its retention settings and its choice under Section 8.3 of the Terms of Use, and its use of the Platform are the Customer's complete Instructions. Any additional Instruction requires Bynn's written agreement and may be subject to additional Fees.

Unlawful Instructions. Bynn shall inform the Customer without delay if, in its opinion, an Instruction infringes Data Protection Laws, and may suspend the processing concerned until the Customer confirms or changes the Instruction.

The Customer's Instructions. The Customer shall ensure that its Instructions comply with Data Protection Laws, and that it has given every notice and obtained every consent needed for Bynn to process Customer Personal Data under the Agreement.

Use limitation and model improvement. Bynn shall not use Customer Personal Data for any purpose other than those in Section 3, and shall not sell it or share it for cross-context behavioural advertising. Bynn uses Customer Data to develop, train or improve its Models only as Section 8.3 of the Terms of Use provides, and to that extent the Customer instructs Bynn to make that use. Bynn shall not use that data to identify or contact Data Subjects, and before any Model, dataset or other derived data is disclosed to a third party, Bynn de-identifies it so that it cannot reasonably be linked to a Data Subject and binds the recipient by contract not to attempt re-identification. De-identified or aggregated data that no longer relates to an identified or identifiable person is not Customer Personal Data.

Biometric processing. Where the Customer uses a Service that analyses images or video of faces, such as an Agemin age check, the Customer instructs Bynn to process the Biometric Data needed to return the Output, such as an estimate of the person's age and a check that a live person is present. For that processing:

1. (a)(a) Bynn shall use the Biometric Data only to return the Output, to keep it for the retention period, and, for Agemin, unless the Customer has opted out under Section 8.3 of the Terms of Use, to keep the video, still frames, facial landmarks, the sequence of colours shown on the screen and the device and camera details of each completed check and use them only to develop and improve its liveness detection, as Section 5.4 of the Privacy Policy describes;
2. (b)(b) Bynn shall not use Biometric Data to identify a person, unless the Service the Customer uses compares faces at the Customer's Instruction, and shall not sell it, lease it, trade it or use it for advertising;
3. (c)(c) Bynn shall restrict access to Biometric Data to personnel who need it for the purposes above and are bound by confidentiality under Section 5;
4. (d)(d) the Customer warrants that its processing has a lawful basis and meets a condition of Article 9(2) of the GDPR or the equivalent provisions of other Data Protection Laws, and that it gives each person the notice, and obtains the written consent, that Data Protection Laws require before the Biometric Data is collected, including for the use in item (a) where the Customer has not opted out of it;
5. (e)(e) Bynn shall destroy Biometric Data as Section 5.6 of the Privacy Policy provides, and as Section 11 provides when the Agreement ends; and
6. (f)(f) Bynn shall assist the Customer, under Section 9, with the data protection impact assessment and any prior consultation that the processing requires before the Customer's first use.

Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, and the risks to Data Subjects, Bynn shall implement and maintain the technical and organisational measures required by Article 32 of the GDPR. They include at least the following categories, which form Annex II of the Standard Contractual Clauses where they apply:

1. (a)(a) encryption of Customer Personal Data in transit over public networks and at rest;
2. (b)(b) access control on a need-to-know basis, with individual accounts and authentication for personnel;
3. (c)(c) management of encryption keys and credentials, including their rotation;
4. (d)(d) logical separation of each customer's data;
5. (e)(e) logging and monitoring of access to production systems;
6. (f)(f) vulnerability management and timely application of security updates;
7. (g)(g) documented procedures for responding to security incidents; and
8. (h)(h) confidentiality undertakings and security training for personnel.

Certification and attestation. Bynn holds a certificate of conformity of its information security management system with ISO/IEC 27001:2022, issued by an accredited certification body, and a SOC 2 report on its controls issued by an independent auditor. The scope of each is as stated in the certificate and the report, which Bynn makes available to Customers through its trust center and on request at security@bynn.com, subject to confidentiality. The trust center also describes the further frameworks Bynn's programme follows; its contents are for information, may change, and do not form part of the Agreement or create a warranty. Bynn shall maintain certification or attestation under ISO/IEC 27001 and SOC 2, or successor frameworks of at least equivalent rigour, during the term of the Agreement.

Updates. Bynn may update the measures from time to time, provided that the update does not materially reduce the overall level of protection of Customer Personal Data.

The Customer's security. The Customer is responsible for the security of its own systems, credentials and API keys, and for deciding whether the measures in this Section 6 are appropriate for the Customer Personal Data it submits.

General authorisation. The Customer gives Bynn general written authorisation to engage Sub-processors. Bynn's Sub-processors fall into the following categories: cloud computing and hosting; computing infrastructure for running Models; payment processing; email delivery; and customer support. The current list, with each Sub-processor's function and location, is available to Customers on request at privacy@bynn.com, and forms Annex III of the Standard Contractual Clauses where they apply.

Notice of changes. Bynn shall give the Customer at least thirty (30) days' notice, by email or in its Account, before authorising a new Sub-processor to process Customer Personal Data.

Right to object. The Customer may object in writing to a new Sub-processor on reasonable grounds relating to data protection within the notice period. Bynn shall discuss the objection with the Customer in good faith and may propose a change to the Customer's configuration or use of the Services that avoids processing by that Sub-processor. If the objection is not resolved within thirty (30) days of its receipt, the Customer may terminate the affected Services by notice, and Bynn shall refund the prepaid Fees attributable to them. This is the Customer's sole and exclusive remedy for its objection.

Urgent replacement. Where a Sub-processor must be replaced urgently for reasons of security or continuity of the Services, Bynn may engage its replacement immediately and shall give notice as soon as practicable; the Customer's right to object under Section 7.3 applies from that notice.

Flow-down and responsibility. Bynn shall impose on each Sub-processor, by written contract, data protection obligations no less protective than those in this DPA, to the extent appropriate to the services the Sub-processor provides, and remains liable to the Customer for each Sub-processor's performance of those obligations to the extent required by Data Protection Laws.

Notice within 72 hours. Bynn shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Content of the notice. The notice shall describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point at security@bynn.com. Where the information is not available at once, Bynn may provide it in phases.

Containment. Bynn shall take reasonable steps to contain, investigate and mitigate the breach, and shall give the Customer reasonable assistance with the notifications to Supervisory Authorities and Data Subjects that the Customer, as Controller, is responsible for making. Bynn shall not notify the Customer's Data Subjects or Supervisory Authorities on the Customer's behalf unless the law requires it or the Customer agrees.

No admission. A notice under this Section 10 is not an acknowledgement of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans and failed log-in attempts, are not Personal Data Breaches.

Information. Bynn shall make available to the Customer the information necessary to demonstrate its compliance with Article 28 of the GDPR, consisting of this DPA, its ISO/IEC 27001 certificate and SOC 2 report under Section 6.2, its security documentation, its answers to a reasonable security questionnaire not more than once in any twelve (12) month period, and any other independent audit report that Bynn chooses to obtain.

Audits and inspections. Where that information is reasonably insufficient to demonstrate compliance, or where a Supervisory Authority requires it, the Customer may carry out an audit, including an inspection, itself or through an independent auditor that is bound by confidentiality and is not a competitor of Bynn. The Customer shall give at least thirty (30) days' written notice, agree the scope in advance, conduct the audit during business hours with minimal disruption, and not seek access to other customers' data or to information unrelated to the processing. Audits are limited to one (1) in any twelve (12) month period, except after a Personal Data Breach or where a Supervisory Authority requires one. The Customer bears its own costs and, where the law permits, Bynn's reasonable costs of supporting the audit. The results are Bynn's Confidential Information.

Standard Contractual Clauses. Audits under the Standard Contractual Clauses are carried out in accordance with this Section 12.

Location of processing. Bynn and its Sub-processors may process Customer Personal Data outside the European Economic Area, the United Kingdom and Switzerland, including in the United States, subject to this Section 13.

European Economic Area. For a Restricted Transfer from the European Economic Area, the Standard Contractual Clauses are incorporated into this DPA, with Module Two (Controller to Processor) applying where the Customer is a Controller and Module Three (Processor to Processor) where it is a Processor, as follows:

1. (a)(a) the docking clause in Clause 7 applies;
2. (b)(b) under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in Section 7.2;
3. (c)(c) the optional wording in Clause 11 does not apply;
4. (d)(d) under Clause 13, the competent Supervisory Authority is that of the Customer's establishment or, where it has none in the European Union, of its representative;
5. (e)(e) under Clause 17, the clauses are governed by the law of Ireland, and under Clause 18, the courts of Ireland have jurisdiction; and
6. (f)(f) Annexes I, II and III are completed by Section 3, Section 6 and Section 7.1 of this DPA and by the details of the parties in the Agreement: Bynn as data importer with the address in Section 21 of the Terms of Use, and the Customer as data exporter with the details in its Account or Order Form. Bynn's representative under Article 27 of the GDPR is Mikael Hedlöf, Östermalmstorg 1, 114 42 Stockholm, Sweden, mikael.hedlof@bynn.com. Bynn's representative under Article 27 of the UK GDPR is Daniel Smedberg, 3-7 Temple Avenue, Temple, London EC4Y 0DT, United Kingdom, daniel.smedberg@bynn.com.

United Kingdom. For a Restricted Transfer from the United Kingdom, the UK Addendum is incorporated into this DPA, with its Tables 1 to 3 completed by the information in this DPA and in Section 13.2, and neither party may end it under its Table 4 except as the UK Addendum requires.

Switzerland. For a Restricted Transfer from Switzerland, the Standard Contractual Clauses apply as set out in Section 13.2, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent Supervisory Authority.

Requests from public authorities. Where legally permitted, Bynn shall notify the Customer of any legally binding request from a public authority for disclosure of Customer Personal Data, shall challenge a request it considers unlawful after careful assessment, and shall disclose only the minimum information the request requires.

Precedence and alternatives. In the event of conflict between this DPA and the Standard Contractual Clauses or the UK Addendum, the latter prevail. If Bynn adopts another lawful transfer mechanism recognised by Data Protection Laws, that mechanism applies in its place to the extent it covers the transfer.

Term. This DPA applies for as long as Bynn processes Customer Personal Data.

Precedence. As to the processing of Customer Personal Data, this DPA prevails over the rest of the Agreement, and the Standard Contractual Clauses prevail over this DPA.

Changes. Bynn may update this DPA where required by a change in Data Protection Laws or a decision of a competent authority, or on at least thirty (30) days' notice under Section 17 of the Terms of Use. No update shall reduce the overall level of protection of Customer Personal Data without the Customer's consent, except as the law requires.