Data Processing Agreement

SWORKSCYBER, LLC d/b/a Rovally

Cybersecurity & Compliance Services

Data Protection Contact

privacy@rovally.com

1111 6th Ave Ste 550, PMB 367700, San Diego, California 92101-5211

This Data Processing Agreement supplements the Master Services Agreement between Rovally and Client.

Version 2.0 — Last Updated: October 23, 2026

1. INTRODUCTION

Summary: This DPA governs how Rovally handles your data when providing services. It supplements our MSA and applies whenever we process personal data on your behalf.

1.1 Purpose

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement (the "Agreement" or "MSA") between SWORKSCYBER, LLC d/b/a Rovally ("Processor," "Provider," or "Rovally") and the entity identified in the applicable Statement of Work ("Controller" or "Client").

This DPA sets forth the terms and conditions under which Processor will process Personal Data on behalf of Controller in connection with the Services provided under the Agreement. This DPA is designed to satisfy the requirements of applicable Data Protection Laws, including, to the extent applicable to Controller, the European Union General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

1.2 Incorporation

This DPA is incorporated into and forms part of the Agreement. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters. All capitalized terms not defined herein shall have the meanings set forth in the Agreement.

Client as Processor. Where Client Processes Personal Data as a processor (or service provider) on behalf of its own customers, references in this DPA to "Controller" include Client in that capacity, Processor acts as Client's sub-processor, and Client warrants that it has obtained from its customers any authorization required to engage Processor and to give the instructions in this DPA. Client's obligations under Section 5 apply equally in that capacity.

1.3 Effective Date

This DPA shall be effective as of the effective date of the Agreement or, if the parties execute this DPA separately as a signed counterpart, the date of last signature on that counterpart.

2. DEFINITIONS

Summary: Key terms used throughout this DPA. Most importantly: you're the Controller (you decide what data to process and why), and we're the Processor (we process data only as you instruct).

"Controller" means the entity that determines the purposes and means of the Processing of Personal Data. Under this DPA, the Client is the Controller.

"Data Protection Laws" means all applicable laws and regulations relating to the Processing of Personal Data, including but not limited to: (a) the EU General Data Protection Regulation 2016/679 ("GDPR"); (b) the UK Data Protection Act 2018 and UK GDPR; (c) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"); (d) the Virginia Consumer Data Protection Act; (e) the Colorado Privacy Act; (f) the Connecticut Data Privacy Act; (g) other U.S. state privacy laws; and (h) any other applicable data protection or privacy legislation.

"Data Subject" means an identified or identifiable natural person whose Personal Data is Processed.

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to: name, identification number, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

"Processing" (including "Process" and "Processed") means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

"Processor" means the entity that Processes Personal Data on behalf of the Controller. Under this DPA, Rovally is the Processor.

"AI-Assisted Tools" means third-party generative AI services used by Processor's personnel, under business terms that prohibit use of inputs and outputs to train or improve models, to assist in preparing Deliverables and performing the Services, as described in Section 7.

"Security Measures" means the technical and organizational measures implemented by Processor to protect Personal Data, as described in Annex II.

"Services" means the cybersecurity, compliance, and IT services provided by Processor to Controller under the Agreement.

"Sub-processor" means any third party engaged by Processor to Process Personal Data on behalf of Controller in connection with the Services.

"Sensitive Personal Data" means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life, or sexual orientation, and (under U.S. laws) Social Security numbers, financial account information, precise geolocation, and other categories designated as sensitive under applicable law.

3. SCOPE OF PROCESSING

Summary: This section describes what data we process, whose data it is, why we process it, and for how long. We only process what's necessary to provide our services.

3.1 Subject Matter and Duration

Processor will Process Personal Data for the duration of the Agreement, unless otherwise agreed in writing or required by applicable law. The subject matter of Processing is the provision of cybersecurity, compliance, and IT services as described in the Agreement and applicable Statements of Work.

3.2 Nature and Purpose of Processing

Processor will Process Personal Data solely for the following purposes:

• Providing the Services described in the Agreement and applicable SOWs
• Managing user accounts and access controls
• Monitoring and responding to security incidents
• Managing compliance programs and evidence collection
• Generating policies, procedures, and compliance documentation
• Responding to security questionnaires and due diligence requests
• Providing IT operations and help desk support
• Managing and securing endpoint devices
• Fulfilling legal and regulatory obligations

3.3 Types of Personal Data

The categories of Personal Data Processed under this DPA may include:

• Identity Data: Names, usernames, employee IDs, job titles, department
• Contact Data: Email addresses, phone numbers, physical addresses
• Technical Data: IP addresses, device identifiers, browser type, operating system, login timestamps, access logs
• Employment Data: Start/end dates, role information, manager relationships, onboarding status
• Security Data: Security training completion, policy acknowledgments, access permissions, authentication records
• Device Data: Device names, serial numbers, compliance status, installed software, patch levels
• Communication Data: Support ticket contents, help desk interactions (limited to service delivery)
• Audio/Video Data: Recordings, transcripts, and notes from meetings and calls conducted to deliver the Services

3.4 Categories of Data Subjects

The Data Subjects whose Personal Data may be Processed include:

• Controller's employees, contractors, and temporary workers
• Controller's authorized users and system administrators
• Controller's customers and business contacts (if included in covered systems)
• Third-party vendor contacts (for vendor risk management)
• Any other individuals whose data is stored in Controller's systems that Processor accesses to provide Services

3.5 Sensitive Personal Data

Processor does not require access to Sensitive Personal Data to perform the Services. Controller shall avoid sharing Sensitive Personal Data with Processor unless explicitly required for a specific service and agreed upon in writing. If Processor inadvertently receives Sensitive Personal Data, Processor will notify Controller and either delete such data or apply enhanced protections as directed by Controller.

4. PROCESSOR OBLIGATIONS

Summary: Our core commitments: we only process data as you instruct, we keep it confidential, we maintain security, and we help you comply with data protection laws.

4.1 Processing Instructions

Processor shall Process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by applicable law. In such case, Processor shall inform Controller of that legal requirement before Processing, unless the law prohibits such notification.

The Agreement, this DPA, and any applicable SOWs constitute Controller's complete and final instructions to Processor for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately in writing. Processor shall inform Controller if, in Processor's opinion, an instruction infringes Data Protection Laws; Processor is not otherwise responsible for determining whether Controller's instructions comply with applicable law.

4.2 Confidentiality

Processor shall ensure that all personnel authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Processor shall ensure that access to Personal Data is limited to those personnel who require such access to perform the Services.

4.3 Security Measures

Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex II. These measures shall include, at a minimum:

• Encryption of Personal Data in transit and at rest
• Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems
• Ability to restore availability and access to Personal Data in a timely manner following an incident
• Regular testing and evaluation of technical and organizational measures
• Access controls and authentication mechanisms
• Audit logging and monitoring

4.4 Assistance with Data Subject Rights

Processor shall assist Controller in responding to requests from Data Subjects exercising their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection. Processor shall promptly notify Controller of any request received directly from a Data Subject and shall not respond to such request except as instructed by Controller or required by law.

4.5 Assistance with Compliance

Taking into account the nature of Processing and the information available to Processor, Processor shall assist Controller in ensuring compliance with Controller's obligations under Data Protection Laws, including:

• Data protection impact assessments
• Prior consultation with supervisory authorities
• Notifications to supervisory authorities and Data Subjects regarding Personal Data Breaches

4.6 Deletion and Return of Data

Upon termination or expiration of the Agreement (or, where the Services under a SOW end, with respect to Personal Data Processed under that SOW), Processor shall, at Controller's election, delete or return all Personal Data to Controller and delete existing copies within thirty (30) days, including Personal Data held in Processor's business systems, in AI-Assisted Tools workspaces, and in Meeting Recordings, except to the extent retention is required by applicable law, the data is subject to a legal hold, or retention is reasonably necessary for the establishment, exercise, or defense of legal claims (the "Retention Exceptions"). Personal Data held in a Sub-processor's backup systems that cannot be deleted within that period will be deleted in the ordinary course of the Sub-processor's retention cycle. Data retained under the Retention Exceptions or in backups remains subject to this DPA until deleted. Processor shall restrict Processing of data retained under a Retention Exception to the purpose justifying that exception and shall delete the data promptly when that reason for retention ends. Processor shall certify in writing that it has complied with this obligation upon Controller's request.

Processor may retain Personal Data to the extent required by applicable law, provided that Processor shall ensure the confidentiality of such Personal Data and shall Process it only as necessary for the purpose(s) specified in the applicable law.

5. CONTROLLER OBLIGATIONS

Summary: Your responsibilities: ensure you have proper legal basis to share data with us, give us accurate instructions, and notify us if regulations change how we should handle your data.

5.1 Lawful Basis

Controller warrants that it has a lawful basis for the Processing of Personal Data as contemplated by this DPA and the Agreement, including any required consents or authorizations from Data Subjects.

5.2 Instructions

Controller shall ensure that its instructions to Processor comply with applicable Data Protection Laws. Except as stated in Section 4.1, Processor is not responsible for determining whether Controller's instructions are compliant with applicable law.

5.3 Data Accuracy

Controller is responsible for ensuring the accuracy and quality of Personal Data provided to Processor. Controller shall promptly notify Processor of any corrections or updates required.

5.4 Regulatory Changes

Processor is responsible for the Data Protection Laws that apply to its own Processing activities under this DPA. Controller shall notify Processor of changes to Controller's own regulatory position that affect that Processing, including new categories of Personal Data, new jurisdictions, or a customer requirement that changes how Processor must handle the data (including a requirement that access be limited to personnel located in the United States). Processor will accommodate such a requirement where it is identified before the applicable SOW is executed; where it is identified later, the parties will agree in a SOW amendment on commercially reasonable terms for accommodating it, and if they cannot agree within thirty (30) days, Controller may terminate the affected Services on thirty (30) days' written notice.

6. SUB-PROCESSORS

Summary: We use vetted sub-processors (listed in Annex I) to help deliver our services. All sub-processors are bound by data protection terms at least as protective as this DPA. We'll notify you of changes.

6.1 Authorization

Controller provides general authorization for Processor to engage Sub-processors to Process Personal Data in connection with the Services, subject to the requirements of this Section 6. The current list of authorized Sub-processors is set forth in Annex I.

6.2 Sub-processor Requirements

Processor shall, with respect to the Sub-processors Processor engages to deliver its Services (including IT operations and personnel partners, AI-Assisted Tools, business systems, and any platform vendor engaged by Processor to Process Personal Data on Controller's behalf, together "Delivery Sub-processors"):

• Enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those set forth in this DPA
• Conduct appropriate due diligence on Sub-processors' security and privacy practices
• Remain fully liable to Controller for the acts and omissions of its Delivery Sub-processors

Managed Third-Party Services that Controller contracts directly with the vendor and Processor administers ("Client-Contracted Platforms") are governed under the vendor's terms pursuant to Section 2.8.4 of the Agreement, with the tenant or subscription provisioned in Controller's name where the vendor permits. They are listed in Annex I for transparency and are not Sub-processors engaged by Processor. Where Processor, rather than Controller, engages a platform vendor to Process Personal Data on Controller's behalf, that vendor is a Delivery Sub-processor and all obligations in this Section 6.2 apply. With respect to Client-Contracted Platforms, Processor shall perform reasonable due diligence on the vendor's security practices before recommending the platform, confirm that the vendor offers data protection terms to Controller, and remain responsible for Processor's own configuration and management of the platform under the Agreement and this DPA; the vendor's own data protection obligations run to Controller under the vendor's terms, and the vendor's acts and omissions are governed by Section 2.8.6 of the Agreement.

6.3 Changes to Sub-processors and Client-Contracted Platforms

Processor shall notify Controller of any intended changes to Sub-processors or Client-Contracted Platforms (additions or replacements) at least thirty (30) days in advance by updating Annex I at www.rovally.com/data-processing-agreement and emailing Controller's designated contact. Controller may object in writing within that period on reasonable grounds related to data protection; absent objection, the change is deemed accepted. If Controller objects and the parties cannot resolve the objection, Controller may terminate the affected Services without penalty. Replacement of a Core Platform (as defined in Section 2.8.3 of the Agreement) additionally requires Controller's consent under that Section.

6.4 Vendor Categories

Delivery Sub-processors and Client-Contracted Platforms fall into the following categories, with their respective roles governed by Section 6.2:

• Security Tool Vendors: Endpoint protection, identity and cloud detection, enterprise browser, and MDM platforms
• Compliance Platform Vendors: GRC automation and compliance management systems
• IT Operations and Personnel Partners: Help desk and IT support service providers, and the employer of record through which Processor engages personnel located outside the United States
• AI-Assisted Tools: Third-party generative AI services used by Processor's personnel to assist in preparing Deliverables (see Section 7)
• Business Systems: Processor's own email, document, video conferencing, collaboration, and work-tracking systems in which Client information may be stored while delivering the Services

6.5 CCPA/CPRA Service Provider Terms

To the extent the CCPA/CPRA applies, Processor acts as a service provider to Controller and: (a) will not sell or share Personal Data; (b) will not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties; (c) will not combine Personal Data with personal information received from other sources, except as permitted by the CCPA/CPRA; (d) certifies that it understands and will comply with these restrictions; (e) will notify Controller if it determines it can no longer meet its obligations under the CCPA/CPRA; and (f) grants Controller the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data. Protected health information is governed by a separate Business Associate Agreement where applicable.

7. AI-ASSISTED TOOLS

Summary: Our consultants use AI tools (currently Anthropic and OpenAI, on business plans) to help draft policies, questionnaire responses, and documentation. Your data is never used to train AI models, work for different clients is kept separate, and everything AI-assisted is reviewed by a person before you get it.

7.1 Overview

Processor's personnel use AI-Assisted Tools to assist in preparing Deliverables and performing the Services. Processor does not operate a proprietary software platform; AI-Assisted Tools are third-party services engaged as Sub-processors and listed in Annex I.

7.2 AI Providers

The AI-Assisted Tools currently used are provided by Anthropic, PBC and OpenAI OpCo, LLC (collectively, "AI Providers") under their respective business terms. Processor maintains the following regarding AI Provider relationships:

• Business Terms: Processor uses the AI Providers' business-tier services under terms that prohibit the use of inputs and outputs to train or improve models and that include data protection commitments
• Sub-processor Status: AI Providers are treated as Sub-processors and are listed in Annex I

7.3 Data Protection Commitments

Processor makes the following commitments regarding Personal Data processed through AI-Assisted Tools:

7.3.1 No Model Training

Controller's Personal Data is not used to train, fine-tune, improve, or develop AI models. The AI Providers' business terms applicable to Processor's accounts prohibit the use of inputs and outputs for model training. This prohibition applies to:

• Initial model training
• Model fine-tuning or customization
• Reinforcement learning from human feedback
• Any other form of machine learning improvement

7.3.2 Client Separation

Processor keeps client work separate within AI-Assisted Tools:

• Controller's data is not combined with data of other Processor clients
• Work for Controller is conducted in separate conversations or projects, with shared memory and cross-project features disabled for client work, and Processor does not reuse one client's inputs or outputs containing that client's Confidential Information or Personal Data for another client (general templates and know-how are Provider Materials under Section 8.1.1 of the Agreement)

7.3.3 Retention

Personal Data processed through AI-Assisted Tools is retained as follows:

• Inputs and outputs are retained by the AI Providers in accordance with their business terms and Processor's workspace settings, and are deleted by Processor at the end of the engagement in accordance with Section 4.6

7.3.4 Security

Data provided to AI-Assisted Tools is protected by:

• TLS 1.2 or higher encryption in transit
• Encryption at rest within AI Provider infrastructure
• Access restricted to Processor's authenticated workspace accounts protected by multi-factor authentication
• Access logging and monitoring

7.4 Use Cases

AI-Assisted Tools are used for the following purposes:

• Policy Generation: Drafting and customizing security policies, procedures, and standards based on Controller's requirements and applicable compliance frameworks
• Questionnaire Support: Assisting with responses to security questionnaires, due diligence requests, and vendor assessments using Controller's documented policies and controls
• Compliance Documentation: Generating control narratives, evidence descriptions, and compliance documentation
• Risk Analysis: Analyzing and documenting risks, control gaps, and remediation recommendations

7.5 Data Minimization

Processor applies data minimization principles to AI processing:

• Only data necessary for the specific task is provided to AI-Assisted Tools
• Personal Data is anonymized or pseudonymized where feasible without compromising service quality
• Sensitive Personal Data is excluded from AI processing unless explicitly required and authorized
• Processor regularly reviews AI processing to identify opportunities for further data minimization

7.6 Human Oversight

All AI-generated content is subject to human review before delivery to Controller. Processor personnel review, validate, and approve AI-assisted content to ensure accuracy, appropriateness, and alignment with Controller's requirements. AI-Assisted Tools are used as productivity tools to assist Processor's qualified consultants, not as autonomous decision-making systems.

7.7 Transparency and Records

Processor maintains records of its use of AI-Assisted Tools and will provide Controller, upon request:

• Confirmation of which Services involve AI-Assisted Tools
• Documentation of data protection measures applicable to AI-Assisted Tools
• The AI Providers' business terms or data processing addenda applicable to Processor's accounts, or relevant excerpts
• AI Provider security certifications (SOC 2, ISO 27001, etc.)

8. RECORDING OF MEETINGS AND COMMUNICATIONS

Summary: We may record and transcribe our calls and meetings with you to capture decisions and action items. We act as your processor for those recordings, announce recording at the start of each meeting, never use recordings to train AI models, and delete them within 30 days after the engagement ends—or sooner on request.

8.1 Authorization

Controller acknowledges and agrees that Processor may record, transcribe, and retain audio, video, and chat content from meetings, calls, and working sessions between the parties conducted in connection with the Services (collectively, "Meeting Recordings"), using the video conferencing and AI-assisted note-taking and transcription tools identified in Annex I.

8.2 Purposes

Processor uses Meeting Recordings solely for purposes related to the delivery and management of the Services, including: documenting decisions, action items, and follow-up tasks; project and engagement tracking; preparing meeting notes and summaries; quality assurance; maintaining continuity; and establishing an accurate record of communications and instructions.

8.3 Roles

Processor Processes Meeting Recordings, and the Personal Data they contain, as Processor on Controller's behalf under this DPA, and the obligations of this DPA (including Sections 4, 6, 9, and 11) apply to them.

8.4 Notice and Consent

Processor will announce at the start of each recorded meeting that the meeting is being recorded, will obtain any participant consent required by applicable law before recording, and will repeat the announcement (or rely on the conferencing tool's recording notice) for participants who join after it. Any participant may decline to be recorded or ask that recording be paused or stopped, and Processor will comply. Controller may instruct Processor in writing not to record meetings with Controller. Each party is responsible for informing its own personnel and attendees that meetings may be recorded.

8.5 Confidentiality

Meeting Recordings, and any transcripts, notes, or summaries derived from them, constitute Confidential Information under the Agreement and are protected accordingly. Access is limited to Processor personnel and authorized Sub-processors who require it for the purposes described in Section 8.2.

8.6 No Model Training

Consistent with Section 7.3.1, Meeting Recordings, transcripts, and derived materials are never used to train, fine-tune, or otherwise develop AI models.

8.7 AI-Assisted Tools and Sub-processors

Where Processor uses third-party or AI-assisted tools to record, transcribe, or summarize meetings, those tools are engaged as Sub-processors in accordance with Section 6 and are subject to the data protection commitments in Section 7. Such tools are identified in Annex I (currently Zoom Communications, Inc. and Notion Labs, Inc.).

8.8 Retention and Deletion

Processor retains Meeting Recordings and derived materials for the duration of the applicable engagement and deletes them within thirty (30) days after the termination or expiration of the Agreement or the applicable SOW, or earlier upon Controller's written request with respect to a specific Meeting Recording, subject only to the Retention Exceptions in Section 4.6.

8.9 Sensitive Personal Data

The parties will avoid discussing or capturing Sensitive Personal Data during recorded meetings. If Sensitive Personal Data is inadvertently captured in a Meeting Recording, Section 3.5 applies.

9. PERSONAL DATA BREACH

Summary: If there's a data breach affecting your data, we'll notify you within 24 hours with all the details you need for regulatory reporting. We'll help you investigate and respond.

9.1 Notification

Processor shall notify Controller without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a Personal Data Breach affecting Controller's Personal Data. Section 5.1 of the Agreement applies the same twenty-four (24) hour period to the broader category of security incidents described there. Notification shall be made to the contact designated in the Agreement or SOW, or if none, to Controller's primary point of contact.

9.2 Notification Contents

The notification shall include, to the extent known:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned
• The name and contact details of Processor's data protection contact
• A description of the likely consequences of the Personal Data Breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate possible adverse effects

9.3 Cooperation

Processor shall cooperate with Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach. Processor shall not inform any third party of the breach without Controller's prior written consent, except (a) as required by law, (b) to Sub-processors who need to know to assist with remediation, and (c) to Processor's legal counsel, insurers, and incident response professionals, each bound by confidentiality obligations.

9.4 Documentation

Processor shall document all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken. This documentation shall be made available to Controller upon request.

10. INTERNATIONAL DATA TRANSFERS

Summary: If we need to transfer data outside your jurisdiction, we'll use approved mechanisms (like Standard Contractual Clauses) to ensure it stays protected. We primarily process data in the United States.

10.1 General

Processor primarily processes Personal Data within the United States. Processor personnel located outside the United States (currently in the Philippines), who may include employees, personnel engaged through an employer of record, and contractors, may access Personal Data remotely to perform the Services. All such personnel are background-checked, bound by written confidentiality and acceptable-use obligations, and subject to the Security Measures in Annex II, and such access occurs only through Processor-managed devices with endpoint protection and full-disk encryption, a managed enterprise browser with multi-factor authentication, and no local storage of Client data; these measures are the safeguards applicable to that access. Where Controller's legal or contractual obligations (including CMMC, FedRAMP, ITAR, or Controller's customer agreements) require it, and Controller identifies the requirement before the applicable SOW is executed, Processor will restrict access to personnel located in the United States, with any resulting pricing or service-level adjustments reflected in the SOW. Processor shall not transfer Personal Data to any other country outside Controller's jurisdiction unless appropriate safeguards are in place as required by applicable Data Protection Laws.

10.2 Transfer Mechanisms

Where required by Data Protection Laws, Processor shall ensure that transfers are made pursuant to:

• An adequacy decision by the relevant authority
• Standard Contractual Clauses approved by the European Commission or UK ICO
• Binding Corporate Rules
• An approved certification mechanism or code of conduct
• Controller's explicit consent, where applicable

10.3 Standard Contractual Clauses

Where the Standard Contractual Clauses ("SCCs") are required, the parties agree that the SCCs shall be incorporated by reference into this DPA. For transfers from the EEA, the EU SCCs (Commission Implementing Decision 2021/914) shall apply, using Module Two (controller to processor) or, where Client acts as a processor, Module Three (processor to processor). For transfers from the UK, the UK Addendum to the EU SCCs shall apply. For transfers from Switzerland, the Swiss Addendum shall apply. This Section 10.3 applies where Personal Data subject to the GDPR, the UK GDPR, or Swiss data protection law is Processed under the Agreement; Controller shall identify such Personal Data in the SOW, and where it applies the SCC annexes are completed by reference to Sections 3 and 10.1 and Annexes I and II of this DPA.

10.4 Transfer Impact Assessments

Where required, Processor shall cooperate with Controller to conduct transfer impact assessments and implement supplementary measures necessary to ensure an essentially equivalent level of protection for transferred Personal Data.

11. AUDIT RIGHTS

Summary: You have the right to verify our compliance through documentation review or, with notice, an audit. We provide a security documentation package on request; additional audits are at your cost with reasonable notice.

11.1 Audit Information

Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws, and shall allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller.

11.2 Audit Procedures

Audits shall be conducted as follows:

• Notice: Controller shall provide at least thirty (30) days prior written notice of any audit, except in cases of suspected breach
• Scope: Audits shall be limited to matters relevant to this DPA and shall not unreasonably interfere with Processor's business operations
• Frequency: No more than one audit per twelve-month period, unless required by a supervisory authority or following a Personal Data Breach
• Confidentiality: Auditors must agree to confidentiality obligations protecting Processor's proprietary information and other clients' data
• Costs: Controller shall bear the costs of any audit, except where the audit reveals material non-compliance by Processor

11.3 Certifications and Reports

Processor may satisfy audit requirements by providing the following security documentation package:

• A completed industry-standard security questionnaire (such as SIG Lite or CAIQ)
• This DPA's Annex II, with evidence of the controls described on reasonable request
• Penetration test or vulnerability assessment results (executive summary), where available
• A certificate of Processor's technology errors and omissions and cyber liability insurance
• Other third-party audit reports or certifications relevant to the Services, where available

Controller agrees that review of such documentation shall satisfy audit requirements absent specific concerns not addressed by the documentation.

12. LIABILITY

Summary: Liability for data protection matters follows the limitations in the MSA, which apply to both parties equally. Each party is responsible for its own regulatory fines caused by its own violations.

12.1 Liability Cap

The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set forth in Section 10 of the Agreement, which apply to each party equally. This DPA does not limit either party's liability for losses which cannot be limited by law.

12.2 Allocation

Each party shall be liable for any fines, penalties, or damages resulting from its own violation of applicable Data Protection Laws. Where both parties are responsible for a violation, liability shall be allocated in proportion to each party's responsibility.

12.3 Indemnification

Each party shall indemnify the other for any fines, penalties, damages, or costs arising from its breach of this DPA or applicable Data Protection Laws, in accordance with the procedures in Section 10A of the Agreement and subject to the limitations in Section 10 of the Agreement.

13. GENERAL PROVISIONS

Summary: Standard legal provisions: this DPA lasts as long as we process your data, amendments must be in writing, and we can update it for legal compliance with notice to you.

13.1 Term

This DPA shall remain in effect for the duration of the Agreement and for as long as Processor continues to Process Personal Data on behalf of Controller.

13.2 Amendment

This DPA may be amended in writing signed by authorized representatives of both parties, or updated by Processor in accordance with Section 13.6 of the Agreement. Sub-processor changes are governed by Section 6.3.

13.3 Severability

If any provision of this DPA is found invalid or unenforceable, the remaining provisions shall continue in full force and effect. The invalid provision shall be modified to the minimum extent necessary to make it valid and enforceable.

13.4 Governing Law

This DPA shall be governed by the laws specified in the Agreement, except that Data Protection Laws of Controller's jurisdiction shall apply to the extent they impose mandatory requirements.

13.5 Conflict

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters. In the event of any conflict between this DPA and applicable Data Protection Laws, the applicable Data Protection Laws shall prevail.

13.6 Entire Agreement

This DPA, together with the Agreement and its appendices, constitutes the entire agreement between the parties with respect to the Processing of Personal Data and supersedes all prior agreements, understandings, and representations with respect to such subject matter.

ANNEX I: SUB-PROCESSORS AND CLIENT-CONTRACTED PLATFORMS

Summary: These are the third parties who may process your data as part of delivering our services. Delivery Sub-processors have data protection agreements with Rovally; Client-Contracted Platforms are the platforms you contract under the vendor's terms and we administer for you.

The following Delivery Sub-processors are authorized to Process Personal Data on behalf of Controller. Client-Contracted Platforms are listed separately for transparency. This list may be updated in accordance with Section 6.3. Entity locations reflect each Sub-processor's headquarters and primary processing region as disclosed by the Sub-processor; a Sub-processor may process data in other regions under its own terms. Client-Contracted Platforms are contracted directly by Controller and are provisioned in Controller's name where the vendor permits; their respective obligations are described in Section 6.2.

Version 2.0 — Last Updated: October 23, 2026

Processor personnel (including personnel engaged through an employer of record) may access Personal Data from the United States and the Philippines (see Section 10.1). Processor does not host Client data on infrastructure of its own.

IT Operations and Personnel Partners (Delivery Sub-processors)

AI-Assisted Tools (Delivery Sub-processors)

Note: AI-Assisted Tools are used under business terms that prohibit model training. See Section 7 for complete data protection commitments.

Security & Compliance Platform Vendors (Client-Contracted Platforms)

Business Systems (Delivery Sub-processors)

Note: Not all listed vendors are used for every Client. Specific Sub-processors and Client-Contracted Platforms are selected based on the Services specified in Client's Statement of Work. Processor may substitute equivalent vendors in accordance with Section 2.8.3 of the Agreement.

ANNEX II: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Summary: The specific security controls we implement to protect your data—encryption, access controls, monitoring, incident response, and more.

Processor implements the following technical and organizational measures to protect Personal Data. These measures are regularly reviewed and updated to address evolving threats and regulatory requirements.

1. Access Control

• Role-based access control (RBAC) limiting access to Personal Data based on job function
• Multi-factor authentication (MFA) required for all systems containing Personal Data
• Unique user identification for all personnel
• Principle of least privilege applied to all access grants
• Regular access reviews (quarterly minimum)
• Prompt access revocation upon personnel departure or role change
• Credentials stored in an enterprise password manager (1Password) with access logging

2. Encryption

• TLS 1.2 or higher for all data in transit
• AES-256 encryption for data at rest
• Full disk encryption on all workstations and portable devices
• Encrypted backup storage
• Secure key management practices

3. Network Security

• Cloud-hosted environment with no Processor-managed network infrastructure or on-premises servers
• Access to Client systems through a managed enterprise browser with isolation and data protection policies
• Regular vulnerability scanning of Processor endpoints

4. Endpoint Security

• Endpoint detection and response (EDR) on all workstations
• Automated patch management
• Mobile device management (MDM) for company devices
• Application whitelisting where applicable

5. Monitoring and Logging

• Centralized security alerting from endpoint, identity, and browser tools
• Audit trail for access to Personal Data
• Log retention in accordance with legal requirements
• Alerts reviewed during Business Hours; after-hours incident declarations handled on a commercially reasonable efforts basis as described in the SLA

6. Physical Security

• Data center physical access controls (cloud providers)
• Clean desk policy
• Secure disposal of hardware and media
• Visitor access controls at office locations

7. Personnel Security

• Background checks for all personnel with access to Personal Data, including personnel engaged through an employer of record
• Written confidentiality and acceptable-use agreements with all personnel
• Regular security awareness training
• Disciplinary procedures for security violations

8. Incident Response

• Documented incident response plan
• Defined roles and responsibilities for incident handling
• Regular incident response testing and tabletop exercises
• Post-incident review and lessons learned process

9. Business Continuity

• Backups of Processor's business systems maintained by the respective SaaS vendors
• Backup testing and restoration procedures
• Disaster recovery planning
• Business continuity testing

10. Vendor Management

• Security assessment of Sub-processors prior to engagement
• Contractual data protection requirements
• Ongoing monitoring of Sub-processor security posture
• Annual review of Sub-processor compliance certifications

11. Assurance

Processor does not currently hold a SOC 2 or ISO 27001 certification. Processor provides the security documentation package described in Section 11.3 of this DPA upon request.

End of Data Processing Agreement