Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between:

• Data Controller: The organisation that has signed up to use SafeTrace ("Customer", "you")
• Data Processor: Aigis Ltd, a company registered in England and Wales, operating the SafeTrace platform ("Aigis Ltd", "we", "us")

This DPA applies where Aigis Ltd processes personal data on behalf of the Customer in connection with the provision of the SafeTrace service. By using SafeTrace, the Customer agrees to the terms of this DPA.

In this DPA, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, as defined in UK GDPR
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure and deletion
• "Data Controller" — the Customer, who determines the purposes and means of processing employee personal data
• "Data Processor" — Aigis Ltd, who processes personal data on behalf of the Customer
• "Data Subject" — the individual whose personal data is being processed (i.e. the Customer's employees)
• "Sub-processor" — any third party engaged by Aigis Ltd to process personal data on its behalf
• "UK GDPR" — the UK General Data Protection Regulation as retained in UK law

Aigis Ltd processes the following categories of personal data on behalf of the Customer:

Processing is carried out solely for the purpose of providing the SafeTrace service as described in the Terms of Service. Aigis Ltd will not process personal data for any other purpose without the Customer's prior written consent.

Aigis Ltd agrees to:

• Process personal data only on documented instructions from the Customer (as set out in the Terms of Service and this DPA)
• Ensure that persons authorised to process personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Customer in fulfilling its obligations to respond to data subject requests
• Delete or return all personal data to the Customer upon termination of the service
• Provide all information necessary to demonstrate compliance with UK GDPR obligations
• Notify the Customer immediately if, in Aigis Ltd's opinion, an instruction infringes UK GDPR

The Customer authorises Aigis Ltd to engage the following sub-processors:

Aigis Ltd will notify the Customer of any intended changes to sub-processors, giving the Customer the opportunity to object. Aigis Ltd will ensure that sub-processors are bound by data protection obligations equivalent to those in this DPA.

Aigis Ltd will assist the Customer in responding to requests from data subjects exercising their rights under UK GDPR, including:

• Right of access — providing copies of personal data held
• Right to rectification — correcting inaccurate data
• Right to erasure — deleting personal data upon request. Administrators can delete individual employee data directly through the SafeTrace dashboard Employee Management panel
• Right to restriction — limiting processing of personal data
• Right to data portability — providing data in a machine-readable format
• Right to object — objecting to certain types of processing

Requests relating to data subject rights should be directed to privacy@aigishq.com. We will respond within 30 days.

Aigis Ltd implements the following technical and organisational security measures:

• All data is encrypted in transit using TLS/SSL
• All data is encrypted at rest by Google Firebase
• Access to the admin dashboard requires authenticated login
• Firebase security rules restrict data access to authorised users only
• Company data is scoped so each organisation can only access their own data
• Passwords are hashed and never stored in plain text
• Regular automated backups of all Firestore data to Google Cloud Storage

In the event of a personal data breach, Aigis Ltd will:

• Notify the Customer without undue delay, and where feasible within 72 hours of becoming aware of the breach
• Provide sufficient information to allow the Customer to meet its own breach reporting obligations
• Co-operate with the Customer and take such reasonable steps as directed to investigate and remedy the breach

Breach notifications will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

Aigis Ltd ensures that all personnel authorised to process personal data under this DPA are subject to appropriate confidentiality obligations. Access to personal data is restricted to those employees and contractors who require it to perform their duties in connection with the SafeTrace service.

In relation to data protection rights, neither party's liability shall be limited by the general limitation of liability provisions in the Terms of Service.

All personal data processed by Aigis Ltd is stored on servers located within the European Union (EU). Our primary data storage locations are:

• Google Firebase Firestore — Belgium (europe-west1)
• Google Firebase Realtime Database — London (europe-west2)
• Google Cloud Storage backups — London (europe-west2)

Aigis Ltd does not transfer personal data outside the UK or EU without appropriate safeguards in place. Where data is transferred to third countries (such as the USA for push notification delivery via Expo), appropriate safeguards are in place including Standard Contractual Clauses.

The Customer has the right to audit Aigis Ltd's data processing activities, subject to the following conditions:

• Audit requests must be submitted in writing with at least 30 days notice
• Audits may be conducted no more than once per calendar year
• Aigis Ltd may satisfy audit requests by providing relevant documentation, completed security questionnaires, or third-party audit reports in lieu of an on-site audit
• Any costs associated with an audit shall be borne by the Customer
• Audits must be conducted during normal business hours and must not unreasonably disrupt Aigis Ltd's operations
• The Customer and any appointed auditors must maintain the confidentiality of any information obtained during an audit

Upon termination of the SafeTrace service agreement:

• Aigis Ltd will cease all processing of the Customer's personal data
• At the Customer's choice, Aigis Ltd will either delete or return all personal data within 30 days of termination
• Aigis Ltd will provide written confirmation that deletion has been completed
• Aigis Ltd may retain personal data where required by applicable law

This DPA is governed by the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

For any questions relating to this Data Processing Agreement, please contact:

• Email: privacy@aigishq.com
• Website: aigishq.com
• Company: Aigis Ltd, Covent Garden, London