Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between BayconAI and Client and governs the processing of personal data on Client's behalf.

Revised October 6, 2026. The provider is identified as Mauricio Nunes Marques, an individual providing services under the BayconAI brand, and contact details are consolidated to ai@bayconai.com. Previous version: May 14, 2026.

1. Definitions

"Applicable Privacy Law" means privacy and data protection laws applicable to the processing of Client Personal Data, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA as amended by the CPRA, and other U.S. state privacy laws.

"Client Personal Data" means personal data processed by BayconAI on behalf of Client under the MSA.

"SCCs" means the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where relevant, the UK International Data Transfer Addendum.

Other capitalized terms have the meanings given by Applicable Privacy Law.

2. Roles and scope

For Client Personal Data, Client is the controller (or business), and BayconAI is the processor (or service provider). Each party will comply with its obligations under Applicable Privacy Law. The duration of processing, the nature and purpose, the types of personal data, and the categories of data subjects are described in Annex A.

3. Processing instructions

BayconAI will process Client Personal Data only on Client's documented instructions (including those reflected in the MSA, SOWs, and this DPA), except where required by law. BayconAI will inform Client if, in its opinion, an instruction infringes Applicable Privacy Law.

4. Confidentiality

BayconAI will ensure personnel and contractors authorized to process Client Personal Data are bound by appropriate confidentiality obligations and are trained on data protection.

5. Sub-processors

Client provides general authorization for BayconAI to engage sub-processors. A current list is at Annex C. BayconAI will: (a) impose data protection obligations on each sub-processor no less protective than this DPA; (b) remain liable for the acts and omissions of its sub-processors as for its own; and (c) notify Client at least thirty (30) days before adding or replacing a sub-processor. Client may reasonably object on data protection grounds; if the parties cannot resolve the objection in good faith, Client may terminate the affected Services on written notice with a pro-rated refund of pre-paid, unused fees.

6. Security

BayconAI will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex B, including measures to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.

7. International transfers

Where Client Personal Data originating in the EEA, UK, or Switzerland is transferred outside those jurisdictions to a country without an adequacy decision, the parties agree the SCCs (Module Two: controller-to-processor, or Module Three where applicable) are incorporated by reference, with Client as data exporter and BayconAI as data importer. The optional docking clause applies. The choices in Clauses 7, 9(a) and (b), 11(a), 17, and 18(b), and the timeframe in Annex II, are completed as set out in Annex A. The UK Addendum (issued by the UK Information Commissioner under S.119A of the Data Protection Act 2018) is also incorporated where applicable, with Tables 1, 2, and 3 completed using the information in this DPA and Annex A.

8. Data subject requests

Taking into account the nature of the processing, BayconAI will assist Client through appropriate technical and organizational measures, insofar as possible, to fulfill Client's obligation to respond to requests for exercising data subject rights. BayconAI will not respond directly to such requests except on Client's instructions or as required by law.

9. Audits

BayconAI will make available to Client information necessary to demonstrate compliance with this DPA, including in the form of third-party audit reports (such as SOC 2) where available. On at least thirty (30) days' written notice, no more than once per year (except after a confirmed personal data breach or as required by a supervisory authority), Client may conduct an audit limited in scope to BayconAI's processing of Client Personal Data, during business hours, under reasonable confidentiality terms, and at Client's expense.

10. Personal data breach

BayconAI will notify Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Client Personal Data. The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.

11. Deletion and return

At Client's choice, BayconAI will delete or return all Client Personal Data after the end of the provision of Services, and delete existing copies unless storage is required by law. BayconAI may retain de-identified or aggregated data that is not reasonably linkable to a data subject.

12. CCPA / CPRA service-provider terms

For Client Personal Data subject to the CCPA, BayconAI acts as Client's "service provider" or "contractor." BayconAI will not: (a) sell or share Client Personal Data; (b) retain, use, or disclose Client Personal Data for any purpose other than the business purposes specified in the MSA and SOWs, including for any commercial purpose other than the business purposes specified, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Client Personal Data outside the direct business relationship; or (d) combine Client Personal Data with personal information received from other sources, except as permitted by the CCPA. BayconAI certifies that it understands these restrictions and will comply with them.

13. Liability and conflict

The liability provisions of the MSA apply to this DPA. To the extent of any conflict between the MSA and this DPA with respect to processing of Client Personal Data, this DPA controls. To the extent of any conflict between this DPA and the SCCs, the SCCs control.

Annex A — Details of processing

Annex B — Technical and organizational security measures

BayconAI maintains a written information security program with measures appropriate to the risk, including:

• Access control. Role-based access with least-privilege; multi-factor authentication for administrative access; access reviews at least quarterly.
• Encryption. Encryption in transit (TLS 1.2+) and at rest for production data stores.
• Network security. Hardened cloud configurations, segmented networks, vulnerability management, and patching cadence.
• Endpoint security. Disk encryption and managed endpoint protection on workforce devices.
• Logging and monitoring. Centralized logging, alerting for anomalous events, and tamper-resistant retention.
• Personnel. Background checks where lawful, mandatory annual security and privacy training, written confidentiality agreements.
• Secure development. Code review, dependency scanning, secret-scanning, environment separation.
• Vendor management. Diligence on sub-processors and contractual data protection obligations.
• Incident response. Documented runbooks, on-call coverage, post-incident reviews, and notification under Section 10.
• Business continuity. Backups with periodic restoration tests; documented recovery objectives.

Specific safeguards for an engagement may be enhanced in the SOW.

Annex C — Approved sub-processors

The list below is illustrative and reflects the categories of sub-processors BayconAI commonly engages. A current, up-to-date list is available on request to ai@bayconai.com.

BayconAI will not transmit Client Personal Data to a third-party foundation model provider in a manner that allows the provider to use that data to train its general-purpose models, except with Client's prior written consent or where the provider's enterprise terms expressly prohibit such training (e.g., OpenAI's API data usage commitments, Anthropic's API terms).

Signed: This DPA is deemed signed and incorporated into the MSA upon the parties' execution of the MSA or any SOW that references this DPA.