Data Processing Agreement

1. Parties, scope and order of precedence

1.1 This Data Processing Agreement (DPA) is made between the client named in the order form, statement of work or online sign-up (the Client, acting as controller) and SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS] — and, from the date on which it assumes the contract by written notice, its Austrian subsidiary [SOVSEC FLEXCO NAME], registered in the Austrian commercial register (Firmenbuch) under FN [FN NUMBER], Landesgericht [COURT], seat [ADDRESS, AUSTRIA] (planned 2028) (SovSec, acting as processor). It is entered into under, and forms part of, the master services agreement, order form, Prismara subscription terms or other written agreement between the parties (the Agreement).

1.2 This DPA applies whenever SovSec processes Client Personal Data in providing the services described in the Agreement (the Services), including SovSec managed services, Microsoft tenant management, managed extended detection and response (MXDR), professional services and the Prismara software-as-a-service applications. Annex I describes the processing for each Service.

1.3 If there is a conflict between this DPA and the Agreement concerning the processing of personal data, this DPA prevails. If there is a conflict between this DPA and any Standard Contractual Clauses incorporated under clause 10, those clauses prevail.

1.4 This DPA does not apply to personal data that SovSec processes as an independent controller — for example, the business contact details of the Client's staff used to manage the commercial relationship, billing records, or data about individual users of Prismara Personal accounts. That processing is described in SovSec's Privacy Policy (SOV-LG-005).

2. Definitions

Terms such as controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the Data Protection Law. In addition:

Term Meaning

Data Protection Law Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Austrian Data Protection Act (DSG) and, for cookies and electronic communications, § 165 of the Austrian Telecommunications Act 2021 (TKG 2021) and the national laws implementing Directive 2002/58/EC, together with any other EU or Member State data protection law applicable to the processing.

Client Personal Data Personal data processed by SovSec on behalf of the Client in providing the Services, as described in Annex I.

Sub-processor Any third party engaged by SovSec that processes Client Personal Data on SovSec's behalf. SovSec's affiliates are Sub-processors when they do so.

Sub-processor List SOV-LG-004 (Sub-processor List), as updated under clause 7.

Restricted Transfer A transfer of Client Personal Data to a country outside the European Economic Area (EEA) that is not covered by an adequacy decision of the European Commission.

Security Incident A personal data breach affecting Client Personal Data in SovSec's or a Sub-processor's custody or control.

Client Tenant A Microsoft 365, Entra ID, Defender or Azure tenant (or comparable third-party environment) that the Client owns and contracts for directly, and which SovSec administers on the Client's instructions.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

Term Meaning

Business Day A day other than a Saturday, Sunday or public holiday in Austria.

SCCs The standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914.

3. Roles and the Client's responsibilities

3.1 The Client is the controller (or, where it acts on behalf of another controller, a processor) of Client Personal Data, and SovSec is its processor (or sub-processor). Where the Client is itself a processor, the Client warrants that its instructions, including the appointment of SovSec, are authorised by the relevant controller.

3.2 The Client is responsible for: (a) having a lawful basis for the processing and for providing any notices to, and obtaining any consents from, data subjects; (b) the accuracy and lawfulness of the Client Personal Data and the means by which it was obtained; (c) deciding which Services, features, retention periods and configurations to use; and (d) its own obligations as controller, including notifying supervisory authorities and data subjects of personal data breaches.

3.3 Where the Client uses a Prismara feature that lets it hold its own encryption keys (for example sealed mailbox storage in Prismara Mail, Prismara Prism vaults or custodian-quorum recovery), the Client is responsible for safeguarding those keys. SovSec cannot recover data protected by keys it does not hold.

3.4 Microsoft and other providers of a Client Tenant contract directly with the Client and act as the Client's processors. They are not SovSec's Sub-processors. SovSec's obligations under this DPA apply to SovSec's own access to and actions in the Client Tenant, not to the provider's processing of the tenant.

4. Processing on documented instructions

4.1 SovSec will process Client Personal Data only on the Client's documented instructions, including with regard to Restricted Transfers, unless required to do so by Union or Member State law to which SovSec is subject. In that case SovSec will inform the Client of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 The Client's documented instructions are: (a) the Agreement and this DPA; (b) the Client's configuration and use of the Services, including actions taken by its administrators in Prismara Admin or a Client Tenant; (c) approved change requests and service desk tickets raised by authorised Client contacts; and (d) any further written instructions agreed by the parties. Instructions that go beyond the Services may be chargeable.

4.3 SovSec will tell the Client promptly if, in its opinion, an instruction infringes Data Protection Law. SovSec may suspend the affected processing until the Client confirms or changes the instruction. This is not legal advice and does not transfer the Client's responsibility for its instructions to SovSec.

4.4 SovSec will not: sell Client Personal Data; use it to train artificial intelligence models; combine it with data from other clients except as needed to provide security detection that the Client has enabled (for example, deriving anonymised indicators of compromise); or put it into third-party AI tools without the Client's prior written instruction.

5. Confidentiality and personnel

5.1 SovSec will ensure that every person it authorises to process Client Personal Data is bound by a written duty of confidentiality or an appropriate statutory obligation of confidentiality, which continues after their engagement ends.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

5.2 Access to Client Personal Data is limited to personnel who need it to provide the Services, is granted on a least- privilege and, where technically possible, time-limited basis, and is reviewed at least quarterly. Personnel receive data protection and security training on joining and at least annually.

6. Security of processing

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to data subjects, SovSec will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in place at the date of this DPA are described in Annex II.

6.2 SovSec operates an information security management system aligned to ISO/IEC 27001 within an integrated management system that is also aligned to ISO 9001 and ISO/IEC 20000-1. SovSec is not currently certified to these standards and will tell the Client if and when certification is obtained.

6.3 SovSec may update the measures in Annex II from time to time, provided that the overall level of protection is not reduced. Material changes will be summarised in SovSec's release notes or service reports.

6.4 All production Services that SovSec hosts are operated on servers located in Vienna, Austria. SovSec will not move the primary storage location of Client Personal Data outside the EEA without the Client's prior written agreement.

7. Sub-processors

7.1 The Client gives SovSec general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA, and those SovSec plans to engage, are listed in the Sub-processor List (SOV- LG-004), which the Client approves by entering into this DPA.

7.2 SovSec will notify the Client of any intended addition or replacement of a Sub-processor at least 30 days before the new Sub-processor processes Client Personal Data. Notice will be given by email to the Client's nominated privacy or contract contact and by updating the Sub-processor List. Clients may also subscribe to change notices by writing to privacy@sovsec.com.

7.3 The Client may object to the change on reasonable grounds relating to data protection by written notice within that 30-day period. The parties will discuss the objection in good faith. If SovSec cannot offer a reasonable alternative (such as not using the Sub-processor for the Client's data), the Client may terminate the affected Service by written notice, without early-termination charges, and SovSec will refund any prepaid fees for the period after termination.

7.4 Where a Sub-processor must be replaced urgently to protect the security or continuity of the Services (for example, because of the Sub-processor's insolvency or a security failure), SovSec may give shorter notice. It will give notice as soon as reasonably possible, and the Client's objection right under clause 7.3 applies from the date of that notice.

7.5 SovSec will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. SovSec remains fully liable to the Client for the performance of each Sub-processor's obligations.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

8. Assistance to the Client

Data subject rights

8.1 Taking into account the nature of the processing, SovSec will assist the Client by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights. Most requests can be met through self-service features (export, rectification, deletion and restriction in Prismara Admin and the relevant applications).

8.2 If SovSec receives a request directly from a data subject relating to Client Personal Data, it will not respond on the merits but will, within 5 Business Days, forward the request to the Client, unless the law requires otherwise. SovSec may tell the data subject that it has done so.

Impact assessments, consultation and other assistance

8.3 SovSec will provide reasonable assistance, taking into account the nature of the processing and the information available to it, with the Client's obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with the supervisory authority. SovSec's standard security documentation, this DPA and the Sub-processor List are provided free of charge; bespoke assistance beyond that is charged at the rates in the Agreement.

8.4 SovSec will cooperate, on request, with the supervisory authority in the performance of its tasks.

9. Security incidents

9.1 SovSec will notify the Client of a Security Incident without undue delay after becoming aware of it. SovSec's target is to notify within 24 hours, and it will in any case notify within 48 hours, so that the Client can meet its own 72-hour notification duty.

9.2 The notification will be made to the Client's nominated security contact by phone and email (and through Prismara Desk where available) and will include, as far as then known: the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Where information is not yet available, SovSec will provide it in phases without further undue delay.

9.3 SovSec will take reasonable steps to contain, investigate and remediate the Security Incident, preserve relevant evidence and logs, and provide the Client with a written incident report once the investigation is complete.

9.4 SovSec will not notify supervisory authorities or data subjects about a Security Incident affecting Client Personal Data on the Client's behalf unless the Client instructs it to or the law requires SovSec to do so. Notification by SovSec is not an acknowledgement of fault or liability.

9.5 Separately from this clause, where SovSec is the manufacturer of a Prismara product, SovSec may have its own reporting obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act) for actively exploited vulnerabilities and severe incidents affecting the security of the product. Such reports do not contain Client Personal Data unless strictly necessary.

10. International transfers

10.1 Client Personal Data in services hosted by SovSec is stored and processed in Austria (EEA). Until the planned Austrian subsidiary assumes the Agreement, SovSec Ltd is established in the United Kingdom, and its personnel there access Client Personal Data from the United Kingdom.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

10.2 Access from the United Kingdom is a transfer to a third country covered by the European Commission's adequacy decision for the United Kingdom under the GDPR, renewed in December 2025 and currently running until 27 December 2031. If that decision is withdrawn, suspended or expires, the parties agree that Module 2 (controller to processor) or, where the Client is itself a processor, Module 3 (processor to processor) of the SCCs applies automatically between the Client (as data exporter) and SovSec Ltd (as data importer), with the elections in clause 10.4.

10.3 SovSec will not make, or permit a Sub-processor to make, any other Restricted Transfer unless it is made under adequacy decisions of the European Commission (including for the United Kingdom) or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or another mechanism under Chapter V GDPR, together with any supplementary measures that a transfer impact assessment shows to be necessary.

10.4 Where the SCCs apply: clause 7 (docking clause) applies; under clause 9(a) option 2 (general written authorisation) applies with the notice period in clause 7.2 of this DPA; the optional language in clause 11 does not apply; under clause 17 option 1 applies and the governing law is that of Austria; under clause 18 the courts of Vienna, Austria have jurisdiction; the competent supervisory authority under clause 13 is the Austrian Data Protection Authority, unless the Client's lead authority is another; and Annexes I to III of this DPA complete the Appendix.

10.5 While SovSec Ltd has no establishment in the Union, it has appointed a representative under Article 27 GDPR: [EU REPRESENTATIVE NAME AND ADDRESS]. The representative may be contacted, in addition to or instead of SovSec, on all issues related to processing.

11. Audits and information

11.1 SovSec will make available to the Client all information necessary to demonstrate compliance with Article 28 GDPR, including on request: this DPA and its annexes, a summary of SovSec's information security policies, the latest penetration test summary (including results of SovSec's own Prismara Crucible testing of its platform), and answers to reasonable security questionnaires (no more than once a year unless following a Security Incident or a request from a supervisory authority).

11.2 If the information under clause 11.1 is not sufficient to demonstrate compliance, the Client (or an independent auditor appointed by it who is not a competitor of SovSec and is bound by confidentiality) may carry out an audit, including an inspection, on at least 30 days' written notice, no more than once in any 12-month period, during Business Day working hours and in a way that does not disrupt the Services or compromise the security or confidentiality of other clients' data. Additional audits are allowed following a Security Incident or where a supervisory authority requires one.

11.3 Each party bears its own costs of an audit, unless the audit reveals a material breach of this DPA by SovSec, in which case SovSec will bear its own costs and reimburse the Client's reasonable audit costs. Audits of Sub- processors' facilities (such as data centres) are carried out by relying on the Sub-processor's own audit reports and certifications, which SovSec will make available where it is permitted to.

12. Return and deletion at the end of the Services

12.1 During the term, the Client can export its data from the Prismara applications in documented, commonly used and machine-readable formats. For Microsoft tenant management, the Client's data remains in the Client Tenant at all times.

12.2 When a Service ends, the Client may export, or ask SovSec to return, the Client Personal Data within 30 days (the exit period). Where Regulation (EU) 2023/2854 (Data Act) applies to a Service, SovSec will also support switching and data portability as set out in the Agreement. After the exit period, SovSec will delete the Client

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

Personal Data from its production systems within a further 30 days, and from encrypted backups when they expire in their normal cycle (no later than 35 days later), unless Union or Member State law requires SovSec to keep it. Retained data stays protected by this DPA for as long as it is kept.

12.3 On request, SovSec will confirm deletion in writing. SovSec will remove its delegated access to any Client Tenant (including GDAP relationships, administrator accounts, application registrations and monitoring agents it installed) at the end of the Services and confirm this in writing.

12.4 Deletion of data protected by client-held keys may be performed by destroying the keys held by SovSec and the encrypted data; SovSec does not hold such data in readable form.

13. Liability

13.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, and the Agreement's liability cap applies to this DPA and the Agreement together, not separately.

13.2 Nothing in this DPA limits either party's liability for intent (Vorsatz) or gross negligence (grobe Fahrlässigkeit), for personal injury, or for any other liability that cannot be limited or excluded under Austrian law.

13.3 Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR. Where both parties are liable to a data subject for the same damage, and one party pays full compensation, that party may recover from the other the part of the compensation corresponding to the other party's share of responsibility for the damage.

14. Term, changes and general

14.1 This DPA takes effect on the date the Agreement takes effect and continues for as long as SovSec processes Client Personal Data, including after the Agreement ends.

14.2 SovSec may update this DPA where required by a change in Data Protection Law, a decision of a supervisory authority or court, or new standard clauses issued by a competent authority, by giving at least 30 days' written notice. Other changes require the written agreement of both parties. Changes will not reduce the level of protection for Client Personal Data.

14.3 If any provision of this DPA is invalid or unenforceable, the rest of the DPA remains in effect, and the invalid provision will be replaced by a valid provision that comes closest to its purpose.

14.4 This DPA is governed by Austrian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG), and the competent court in Vienna, Austria (Innere Stadt) have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise.

14.5 Notices under this DPA must be in writing. Notices to SovSec go to privacy@sovsec.com (with a copy to legal@sovsec.com); security incident contacts are security@sovsec.com. Notices to the Client go to the contacts named in the order form or Prismara Admin.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

15. Annex I — Description of the processing

A. Parties

Controller (data exporter) Processor (data importer)

 Name         The Client, as named in the             SovSec Ltd; from assumption by notice, [SOVSEC FLEXCO NAME]
              Agreement

 Address      As stated in the Agreement              [REGISTERED OFFICE ADDRESS] · EU representative: [EU
                                                      REPRESENTATIVE NAME AND ADDRESS]

 Contact      Privacy / DPO contact named in the      Jake Gliddon, Founder · privacy@sovsec.com
              order form

 Role         Controller (or processor on behalf of   Processor (or sub-processor)
              its own client)

 Activities   Use of the Services under the           Provision of the Services under the Agreement
              Agreement

B. Categories of data subjects

• The Client's employees, contractors, agents, temporary staff and directors (including users of Prismara or the Client Tenant).
• The Client's customers, suppliers, partners and other business contacts whose data is held in the Client's systems.
• Job applicants and former staff (Prismara HR), and leads and contacts (Prismara CRM).
• Individuals who correspond with the Client's users by email, chat, meetings or file sharing (Prismara Mail, Talk, Spaces, Work).
• Individuals whose activity is recorded in security telemetry from the Client's devices, identities, networks and applications (including visitors on guest networks where monitored).
• Any other individuals whose personal data the Client chooses to store or process using the Services.

C. Categories of personal data

• Identity and directory data: name, username, job title, department, manager, work contact details, profile photo, group memberships, authentication factors (stored as public keys or hashes), sign-in records.
• Device and technical data: device identifiers, hostnames, IP and MAC addresses, operating system and software inventory, configuration and compliance state, location data where the Client enables device location in Prismara Core.
• Security telemetry: process, file, registry, network, DNS, authentication, email and cloud audit events; alerts, incidents and investigation notes; file hashes and, where enabled, suspicious file samples; browsing and connection metadata routed through Prismara ZTNA or Prismara Browser policies.
• Content data: emails, attachments, chat messages, meeting recordings and transcripts (if enabled), documents, spreadsheets, presentations, files, calendar entries and vault items, as stored by users.
• Service management data: tickets, requests, change records, call notes and attachments submitted to Prismara Desk or SovSec support.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

• Business records: CRM records, HR records (contract, pay grade, leave, performance, emergency contacts), ERP records (projects, timesheets, invoices, expenses).
• Test findings: personal data incidentally exposed during Prismara Crucible or manual penetration testing (for example usernames, email addresses, weak or leaked credentials).

D. Special categories and criminal offence data The Services are not designed to process special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). They may nevertheless be present in content the Client chooses to store — for example health information in an HR absence record or an email, or evidence of a possible offence identified during an incident investigation. Where present, they are protected by the measures in Annex II, including encryption at rest and role-based access. The Client should use Prismara Gov sensitivity labels and the Prismara HR restricted-field feature to limit access further and should tell SovSec in writing if it intends to process special categories at scale.

E. Processing operations, purpose and duration per Service Nature of processing for all Services: collection, storage, organisation, retrieval, consultation, analysis, transmission, restriction, backup and erasure, as necessary to provide, secure, support and maintain the Services. Frequency: continuous for the term. Duration: the term of the Agreement plus the exit and deletion periods in clause 12.

 Service                        Processing operations and purpose                                                            Where

 Prismara Identity & Admin      Directory, authentication (passkeys, MFA), single sign-on, tenant administration, audit      Vienna (AT)
                                logging, licence assignment.

 Prismara Mail, Talk, Spaces,   Hosting and delivery of email, chat, meetings, files and documents; spam and malware         Vienna (AT)
 Work                           filtering; search indexing; retention and legal hold as configured by the Client; sealed
                                storage with client-held keys where enabled.

 Prismara Prism (password       Storing end-to-end encrypted vault items. SovSec processes only encrypted blobs and          Vienna (AT)
 manager)                       account metadata; it cannot read vault contents.

 Prismara Core (UEM/MDM)        Device enrolment, configuration, compliance, patch and software deployment, remote           Vienna (AT); agent on
 and Reach (RMM)                support sessions initiated or approved under the Agreement, inventory.                       Client devices

 Prismara Endpoint, ZTNA,       Collection of endpoint and connection telemetry, policy enforcement, threat detection and    Vienna (AT); agents on
 Browser                        response actions (isolation, quarantine).                                                    Client devices

 Prismara SOC / MXDR            Ingestion and correlation of telemetry from Prismara products, detection, triage,            Vienna (AT); analysts
 (Prismara telemetry)           investigation, response actions authorised in the runbook, incident reporting. Prismara      in UK / EU; EU partner
                                SOC processes Prismara telemetry only.                                                       SOC (planned 2028)

 Interim third-party EDR        Until Prismara Endpoint is generally available, endpoint telemetry processed by the          Per SOV-LG-004 (EU)
 (Secure / Sovereign plans)     European EDR vendor listed in SOV-LG-004 and monitored by SovSec.

 Microsoft tenant management    Administration of the Client Tenant through Microsoft Granular Delegated Admin Privileges    Client Tenant
 (Foundation / Secure /         (GDAP) from SovSec's dedicated administration tenant: user lifecycle, configuration,         (Microsoft, per Client's
 Sovereign) and MXDR in         Secure Score reviews, investigation and response in the Client's Defender XDR / Sentinel.    contract); access from
 Defender XDR / Sentinel        Client data stays in the Client Tenant; SovSec views and acts on it there and exports only   UK / EU
                                what is needed for tickets or incident reports.

 Prismara Crucible and          Automated and manual security testing of in-scope systems under a written authorisation      Vienna (AT); test origin
 penetration testing            and rules of engagement; recording findings and evidence; minimising and redacting           as stated in
                                personal data in reports.                                                                    authorisation

 Prismara Desk and SovSec       Logging and handling of tickets, requests, incidents and changes; remote sessions;           Vienna (AT)
 support                        communications with requesters.

 Prismara Gov                   Data classification, data loss prevention, retention, eDiscovery and compliance reporting    Vienna (AT)
                                configured by the Client.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

 Service                        Processing operations and purpose                                                            Where

 Prismara CRM, HR, ERP          Hosting the Client's business records and workflows as configured by the Client.             Vienna (AT)

 Prismara Cloud                 Infrastructure hosting of Client workloads. SovSec does not access data inside Client        Austrian sovereign
                                workloads except to provide support the Client requests.                                     infrastructure (AT)

 Professional services          Accessing, reviewing and transferring Client data as needed for the agreed scope; forensic   As stated in the
 (consulting, vCISO, incident   collection and analysis in incident response; migration of mailboxes and files into          statement of work
 response, migration, NIS2      Prismara.
 readiness)

F. Competent supervisory authority The supervisory authority of the Member State in which the Client is established (lead authority) or, where clause 13 SCCs requires otherwise, the authority determined under that clause. For Clients established in Austria: the Austrian Data Protection Authority (Datenschutzbehörde).

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

16. Annex II — Technical and organisational measures

The following measures apply to the Services SovSec hosts and operates. For Microsoft tenant management, the measures apply to SovSec's access to and actions in the Client Tenant; the security of the tenant itself is provided by Microsoft under the Client's own agreement and by the configuration the Client approves.

Area Measures

Governance Information security management system aligned to ISO/IEC 27001 (not certified), with policies, risk register, statement of applicability, internal audit and management review; named security owner (Founder); policies reviewed at least annually.

Encryption in TLS 1.3 for all external connections with hybrid post-quantum key exchange (X25519MLKEM768); HSTS on all web domains; transit legacy protocols disabled. Internal service-to-service traffic encrypted with mutual TLS.

Encryption at rest All production storage and backups encrypted with AES-256 (or an equivalent algorithm). Keys held in a dedicated key management service, separated from data, rotated on a defined schedule.

Client-held keys Where the product supports it — Prismara Mail sealed storage, Prismara Prism vaults, custodian-quorum recovery — content is encrypted with keys SovSec does not hold in usable form, so SovSec staff cannot read it.

Token and code Authentication tokens signed with a hybrid signature (ML-DSA-65 + ES256). Software builds reproducible where practical, integrity signed, and shipped with a software bill of materials (SBOM).

Tenant isolation Logical multi-tenancy with database row-level security (RLS) enforcing the tenant identifier on every query, separate encryption keys per tenant where supported, and automated tests that check for cross-tenant access.

Identity and Single sign-on for all staff; phishing-resistant MFA (FIDO2 / passkeys) mandatory for all administrative and production access; access least privilege; just-in-time elevation for production; quarterly access reviews; immediate revocation on leaving.

Microsoft Access to Client Tenants only through GDAP relationships with the least-privileged roles needed, time-bound and renewed with delegated access the Client's approval; no standing Global Administrator; SovSec administration tenant used for nothing else, with phishing- resistant MFA and Conditional Access; all actions logged in the Client Tenant's audit log.

Logging and Centralised, tamper-evident logging of administrative actions, authentication and security events, retained for at least 12 months; monitoring continuous monitoring of SovSec's own platform with Prismara SOC; alerting on anomalous staff access to client data.

Vulnerability Automated dependency and container scanning; patching of critical vulnerabilities within 72 hours and high within 14 days where management a fix is available; regular automated testing with Prismara Crucible and annual independent penetration test; coordinated vulnerability disclosure via security@sovsec.com; vulnerability handling and reporting as required by the Cyber Resilience Act.

Secure Secure development lifecycle with threat modelling, peer review of all changes, static analysis, secret scanning, protected development branches and separate development, test and production environments. Production data is not used for testing; demo environments use fictional data only.

Network security Default-deny firewalls, segmentation between management, application and data tiers; administrative interfaces reachable only through Prismara ZTNA; DDoS mitigation by the hosting provider.

Backups and Encrypted daily backups kept within the EU, retained for up to 35 days, with restore tests at least quarterly; documented resilience business continuity and disaster recovery plans tested at least annually.

Physical security Production servers hosted in netcup GmbH's Vienna, Austria data centre with access control, video surveillance, fire suppression, redundant power and cooling, as described in netcup's data processing agreement. SovSec staff have no physical access; failed disks are destroyed by the provider.

Personnel Confidentiality undertakings; background checks proportionate to role and permitted by law; onboarding and annual security and data protection training; disciplinary process for breaches.

Incident Documented incident response plan; 24×7 on-call for Sovereign-tier and platform incidents; customer notification as in clause 9; management post-incident reviews.

Data minimisation Telemetry collection limited to security-relevant fields; configurable retention per tenant; deletion and secure erasure processes and retention as in clause 12; pseudonymisation of analytics and service metrics.

Supplier Due diligence and written data protection terms for each Sub-processor; annual review of Sub-processors' security; EU hosting management required for any Sub-processor that stores Client Personal Data.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

Area Measures

Endpoints of Managed by Prismara Core with full-disk encryption, EDR, automatic updates and screen lock; client data is not stored locally SovSec staff except temporarily and encrypted, where needed for an investigation.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

17. Annex III — Sub-processors

The Client authorises the Sub-processors listed in SOV-LG-004 (Sub-processor List), as updated in accordance with clause 7. At the date of this DPA the list includes:

  Sub-processor                     Purpose                                            Location    Status

  netcup GmbH (Germany)             Dedicated server hosting for all production        Vienna,     Current
                                    Services                                           Austria

  ESET or WithSecure (EU) —         Interim EDR for Secure / Sovereign plans           EU          Planned — from service launch
  one vendor, to be confirmed       until Prismara Endpoint GA

  [PARTNER SOC NAME] (EU)           24×7 monitoring cover for Sovereign plans          EU / EEA    Planned — 2028

  GitHub, Inc. (USA)                Source code hosting; no Client Personal            USA /       Current — to be replaced by EU-
                                    Data intended                                      global      hosted Git before general availability

  Stripe (personal tiers only)      Payment processing for Prismara Personal;          EU / UK     Planned — at paid launch
                                    not used for business Client Personal Data

The current version of the Sub-processor List is available on request from privacy@sovsec.com and will be published at sovsec.com/legal.

18. Signatures

Signed by the authorised representatives of the parties. Where the Agreement is accepted electronically, this DPA is accepted with it and no separate signature is needed.

For the Client (controller) For SovSec (processor)

Name: Name: Jake Gliddon Title: Title: Founder and Director Date: Date: Signature: Signature:

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · EU

Drafting notes — remove before publication

• Placeholders: [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [PARTNER SOC NAME], [EU REPRESENTATIVE NAME AND ADDRESS], [SOVSEC FLEXCO NAME].
• Cross-reference the master services agreement and online terms by their final document IDs once fixed; confirm the 'Agreement' definition matches.
• Confirm the Annex II figures reflect actual operations before publication (patch windows 72 h / 14 d, backup retention 35 days, log retention 12 months, quarterly restore tests and access reviews, AES-256).
• Confirm the exit/deletion timeline (30 + 30 days, backups ≤35 days) and its interaction with the Data Act switching terms in the Agreement (EU edition).
• Commercial decision: whether to offer a separate (higher) liability cap for data protection breaches; currently the Agreement cap applies.
• Breach notice target 24 h / maximum 48 h is stricter than many market DPAs — confirm it can be met operationally, including weekends for Foundation tier clients.
• Verified 2 Nov 2026: the European Commission renewed the UK adequacy decision under the GDPR in December 2025, running to 27 December 2031 (mid-term review around 2029). Rechtsanwalt to confirm the automatic SCC fallback wording in clause 10.2.
• Rechtsanwalt to confirm that an Art. 27 representative is required (SovSec Ltd offers Prismara Personal directly to EU consumers, so Art. 3(2)(a) GDPR is likely to apply) and to review clause 10.4 SCC elections (Austrian law, Vienna courts).
• Once the Austrian FlexCo assumes the Agreement, transfers to the UK become intra-group access from a third country — update clause 10 and Annex I accordingly.

End of SOV-LG-003 Data Processing Agreement v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

1. Parties, scope and order of precedence

1.1 This Data Processing Agreement (DPA) is made between the client named in the order form, statement of work or online sign-up (the Client, acting as controller) and SovSec Ltd, a private limited company registered in England and Wales under company number [COMPANY NUMBER], whose registered office is at [REGISTERED OFFICE ADDRESS] (SovSec, acting as processor). It is entered into under, and forms part of, the master services agreement, order form, Prismara subscription terms or other written agreement between the parties (the Agreement).

1.2 This DPA applies whenever SovSec processes Client Personal Data in providing the services described in the Agreement (the Services), including SovSec managed services, Microsoft tenant management, managed extended detection and response (MXDR), professional services and the Prismara software-as-a-service applications. Annex I describes the processing for each Service.

1.3 If there is a conflict between this DPA and the Agreement concerning the processing of personal data, this DPA prevails. If there is a conflict between this DPA and any Standard Contractual Clauses, the UK Addendum or the IDTA incorporated under clause 10, those clauses prevail.

1.4 This DPA does not apply to personal data that SovSec processes as an independent controller — for example, the business contact details of the Client's staff used to manage the commercial relationship, billing records, or data about individual users of Prismara Personal accounts. That processing is described in SovSec's Privacy Policy (SOV-LG-005).

2. Definitions

Terms such as controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the Data Protection Law. In addition:

Term Meaning

Data Protection Law the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended (including by the Data (Use and Access) Act 2025).

Client Personal Data Personal data processed by SovSec on behalf of the Client in providing the Services, as described in Annex I.

Sub-processor Any third party engaged by SovSec that processes Client Personal Data on SovSec's behalf. SovSec's affiliates are Sub-processors when they do so.

Sub-processor List SOV-LG-004 (Sub-processor List), as updated under clause 7.

Restricted Transfer A transfer of Client Personal Data to a country outside the United Kingdom that is not covered by UK adequacy regulations.

Security Incident A personal data breach affecting Client Personal Data in SovSec's or a Sub-processor's custody or control.

Client Tenant A Microsoft 365, Entra ID, Defender or Azure tenant (or comparable third-party environment) that the Client owns and contracts for directly, and which SovSec administers on the Client's instructions.

Business Day A day other than a Saturday, Sunday or public holiday in England.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

Term Meaning

UK Addendum / IDTA The International Data Transfer Addendum to the EU Standard Contractual Clauses, and the International Data Transfer Agreement, each issued by the Information Commissioner under section 119A of the Data Protection Act 2018.

3. Roles and the Client's responsibilities

3.1 The Client is the controller (or, where it acts on behalf of another controller, a processor) of Client Personal Data, and SovSec is its processor (or sub-processor). Where the Client is itself a processor, the Client warrants that its instructions, including the appointment of SovSec, are authorised by the relevant controller.

3.2 The Client is responsible for: (a) having a lawful basis for the processing and for providing any notices to, and obtaining any consents from, data subjects; (b) the accuracy and lawfulness of the Client Personal Data and the means by which it was obtained; (c) deciding which Services, features, retention periods and configurations to use; and (d) its own obligations as controller, including notifying supervisory authorities and data subjects of personal data breaches.

3.3 Where the Client uses a Prismara feature that lets it hold its own encryption keys (for example sealed mailbox storage in Prismara Mail, Prismara Prism vaults or custodian-quorum recovery), the Client is responsible for safeguarding those keys. SovSec cannot recover data protected by keys it does not hold.

3.4 Microsoft and other providers of a Client Tenant contract directly with the Client and act as the Client's processors. They are not SovSec's Sub-processors. SovSec's obligations under this DPA apply to SovSec's own access to and actions in the Client Tenant, not to the provider's processing of the tenant.

4. Processing on documented instructions

4.1 SovSec will process Client Personal Data only on the Client's documented instructions, including with regard to Restricted Transfers, unless required to do so by the law of the United Kingdom or a part of it to which SovSec is subject. In that case SovSec will inform the Client of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 The Client's documented instructions are: (a) the Agreement and this DPA; (b) the Client's configuration and use of the Services, including actions taken by its administrators in Prismara Admin or a Client Tenant; (c) approved change requests and service desk tickets raised by authorised Client contacts; and (d) any further written instructions agreed by the parties. Instructions that go beyond the Services may be chargeable.

4.3 SovSec will tell the Client promptly if, in its opinion, an instruction infringes Data Protection Law. SovSec may suspend the affected processing until the Client confirms or changes the instruction. This is not legal advice and does not transfer the Client's responsibility for its instructions to SovSec.

4.4 SovSec will not: sell Client Personal Data; use it to train artificial intelligence models; combine it with data from other clients except as needed to provide security detection that the Client has enabled (for example, deriving anonymised indicators of compromise); or put it into third-party AI tools without the Client's prior written instruction.

5. Confidentiality and personnel

5.1 SovSec will ensure that every person it authorises to process Client Personal Data is bound by a written duty of confidentiality or an appropriate statutory obligation of confidentiality, which continues after their engagement ends.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

5.2 Access to Client Personal Data is limited to personnel who need it to provide the Services, is granted on a least- privilege and, where technically possible, time-limited basis, and is reviewed at least quarterly. Personnel receive data protection and security training on joining and at least annually.

6. Security of processing

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to data subjects, SovSec will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR. The measures in place at the date of this DPA are described in Annex II.

6.2 SovSec operates an information security management system aligned to ISO/IEC 27001 within an integrated management system that is also aligned to ISO 9001 and ISO/IEC 20000-1. SovSec is not currently certified to these standards and will tell the Client if and when certification is obtained.

6.3 SovSec may update the measures in Annex II from time to time, provided that the overall level of protection is not reduced. Material changes will be summarised in SovSec's release notes or service reports.

6.4 All production Services that SovSec hosts are operated on servers located in Vienna, Austria. SovSec will not move the primary storage location of Client Personal Data outside the EEA without the Client's prior written agreement.

7. Sub-processors

7.1 The Client gives SovSec general written authorisation to engage Sub-processors. The Sub-processors engaged at the date of this DPA, and those SovSec plans to engage, are listed in the Sub-processor List (SOV- LG-004), which the Client approves by entering into this DPA.

7.2 SovSec will notify the Client of any intended addition or replacement of a Sub-processor at least 30 days before the new Sub-processor processes Client Personal Data. Notice will be given by email to the Client's nominated privacy or contract contact and by updating the Sub-processor List. Clients may also subscribe to change notices by writing to privacy@sovsec.com.

7.3 The Client may object to the change on reasonable grounds relating to data protection by written notice within that 30-day period. The parties will discuss the objection in good faith. If SovSec cannot offer a reasonable alternative (such as not using the Sub-processor for the Client's data), the Client may terminate the affected Service by written notice, without early-termination charges, and SovSec will refund any prepaid fees for the period after termination.

7.4 Where a Sub-processor must be replaced urgently to protect the security or continuity of the Services (for example, because of the Sub-processor's insolvency or a security failure), SovSec may give shorter notice. It will give notice as soon as reasonably possible, and the Client's objection right under clause 7.3 applies from the date of that notice.

7.5 SovSec will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. SovSec remains fully liable to the Client for the performance of each Sub-processor's obligations.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

8. Assistance to the Client

Data subject rights

8.1 Taking into account the nature of the processing, SovSec will assist the Client by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights. Most requests can be met through self-service features (export, rectification, deletion and restriction in Prismara Admin and the relevant applications).

8.2 If SovSec receives a request directly from a data subject relating to Client Personal Data, it will not respond on the merits but will, within 5 Business Days, forward the request to the Client, unless the law requires otherwise. SovSec may tell the data subject that it has done so.

Impact assessments, consultation and other assistance

8.3 SovSec will provide reasonable assistance, taking into account the nature of the processing and the information available to it, with the Client's obligations under Articles 32 to 36 UK GDPR, including data protection impact assessments and prior consultation with the supervisory authority. SovSec's standard security documentation, this DPA and the Sub-processor List are provided free of charge; bespoke assistance beyond that is charged at the rates in the Agreement.

8.4 SovSec will cooperate, on request, with the supervisory authority in the performance of its tasks.

9. Security incidents

9.1 SovSec will notify the Client of a Security Incident without undue delay after becoming aware of it. SovSec's target is to notify within 24 hours, and it will in any case notify within 48 hours, so that the Client can meet its own 72-hour notification duty.

9.2 The notification will be made to the Client's nominated security contact by phone and email (and through Prismara Desk where available) and will include, as far as then known: the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Where information is not yet available, SovSec will provide it in phases without further undue delay.

9.3 SovSec will take reasonable steps to contain, investigate and remediate the Security Incident, preserve relevant evidence and logs, and provide the Client with a written incident report once the investigation is complete.

9.4 SovSec will not notify supervisory authorities or data subjects about a Security Incident affecting Client Personal Data on the Client's behalf unless the Client instructs it to or the law requires SovSec to do so. Notification by SovSec is not an acknowledgement of fault or liability.

9.5 Separately from this clause, where SovSec is the manufacturer of a Prismara product, SovSec may have its own reporting obligations under Regulation (EU) 2024/2847 (Cyber Resilience Act) for actively exploited vulnerabilities and severe incidents affecting the security of the product. Such reports do not contain Client Personal Data unless strictly necessary.

10. International transfers

10.1 Client Personal Data in services hosted by SovSec is stored and processed in Austria (EEA). Transfers from the United Kingdom to the EEA are permitted under the UK's adequacy regulations in respect of the EEA states. SovSec personnel based in the United Kingdom access the data from the United Kingdom.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

10.2 SovSec will not make, or permit a Sub-processor to make, a Restricted Transfer unless it is made under UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism permitted by UK Data Protection Law, together with any supplementary measures that a transfer risk assessment shows to be necessary.

10.3 Where the Client is itself subject to the EU GDPR for the Client Personal Data (for example, because it has EEA establishments), the European Commission's adequacy decision for the United Kingdom (renewed in December 2025 and currently running until 27 December 2031) covers access by SovSec from the United Kingdom. If that decision ceases to apply, the parties agree that Module 2 (or, where the Client is a processor, Module 3) of the EU Standard Contractual Clauses applies, with the elections in clause 10.4.

10.4 Where the UK Addendum or the EU Standard Contractual Clauses are incorporated by this DPA: the optional docking clause (clause 7) applies; under clause 9 option 2 (general written authorisation) applies with the notice period in clause 7.2 of this DPA; the optional language in clause 11 does not apply; the governing law and forum are those of Ireland for the EU Standard Contractual Clauses alone, and of England and Wales for the UK Addendum; and Annexes I to III of this DPA complete the Appendix. Neither party may end the UK Addendum under its Table 4 except as agreed in writing.

11. Audits and information

11.1 SovSec will make available to the Client all information necessary to demonstrate compliance with Article 28 UK GDPR, including on request: this DPA and its annexes, a summary of SovSec's information security policies, the latest penetration test summary (including results of SovSec's own Prismara Crucible testing of its platform), and answers to reasonable security questionnaires (no more than once a year unless following a Security Incident or a request from a supervisory authority).

11.2 If the information under clause 11.1 is not sufficient to demonstrate compliance, the Client (or an independent auditor appointed by it who is not a competitor of SovSec and is bound by confidentiality) may carry out an audit, including an inspection, on at least 30 days' written notice, no more than once in any 12-month period, during Business Day working hours and in a way that does not disrupt the Services or compromise the security or confidentiality of other clients' data. Additional audits are allowed following a Security Incident or where a supervisory authority requires one.

11.3 Each party bears its own costs of an audit, unless the audit reveals a material breach of this DPA by SovSec, in which case SovSec will bear its own costs and reimburse the Client's reasonable audit costs. Audits of Sub- processors' facilities (such as data centres) are carried out by relying on the Sub-processor's own audit reports and certifications, which SovSec will make available where it is permitted to.

12. Return and deletion at the end of the Services

12.1 During the term, the Client can export its data from the Prismara applications in documented, commonly used and machine-readable formats. For Microsoft tenant management, the Client's data remains in the Client Tenant at all times.

12.2 When a Service ends, the Client may export, or ask SovSec to return, the Client Personal Data within 30 days (the exit period). After the exit period, SovSec will delete the Client Personal Data from its production systems within a further 30 days, and from encrypted backups when they expire in their normal cycle (no later than 35 days later), unless UK law requires SovSec to keep it. Retained data stays protected by this DPA for as long as it is kept.

12.3 On request, SovSec will confirm deletion in writing. SovSec will remove its delegated access to any Client Tenant (including GDAP relationships, administrator accounts, application registrations and monitoring agents it installed) at the end of the Services and confirm this in writing.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

12.4 Deletion of data protected by client-held keys may be performed by destroying the keys held by SovSec and the encrypted data; SovSec does not hold such data in readable form.

13. Liability

13.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, and the Agreement's liability cap applies to this DPA and the Agreement together, not separately.

13.2 Nothing in this DPA limits either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be limited or excluded under the laws of England and Wales.

13.3 Nothing in this DPA limits either party's liability to data subjects under Article 82 UK GDPR. Where both parties are liable to a data subject for the same damage, and one party pays full compensation, that party may recover from the other the part of the compensation corresponding to the other party's share of responsibility for the damage.

14. Term, changes and general

14.1 This DPA takes effect on the date the Agreement takes effect and continues for as long as SovSec processes Client Personal Data, including after the Agreement ends.

14.2 SovSec may update this DPA where required by a change in Data Protection Law, a decision of a supervisory authority or court, or new standard clauses issued by a competent authority, by giving at least 30 days' written notice. Other changes require the written agreement of both parties. Changes will not reduce the level of protection for Client Personal Data.

14.3 If any provision of this DPA is invalid or unenforceable, the rest of the DPA remains in effect, and the invalid provision will be replaced by a valid provision that comes closest to its purpose.

14.4 This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses, UK Addendum or IDTA require otherwise.

14.5 Notices under this DPA must be in writing. Notices to SovSec go to privacy@sovsec.com (with a copy to legal@sovsec.com); security incident contacts are security@sovsec.com. Notices to the Client go to the contacts named in the order form or Prismara Admin.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

15. Annex I — Description of the processing

A. Parties

Controller (data exporter) Processor (data importer)

 Name          The Client, as named in the Agreement                                  SovSec Ltd

 Address       As stated in the Agreement                                             [REGISTERED OFFICE ADDRESS]

 Contact       Privacy / DPO contact named in the order form                          Jake Gliddon, Founder · privacy@sovsec.com

 Role          Controller (or processor on behalf of its own client)                  Processor (or sub-processor)

 Activities    Use of the Services under the Agreement                                Provision of the Services under the Agreement

B. Categories of data subjects

• The Client's employees, contractors, agents, temporary staff and directors (including users of Prismara or the Client Tenant).
• The Client's customers, suppliers, partners and other business contacts whose data is held in the Client's systems.
• Job applicants and former staff (Prismara HR), and leads and contacts (Prismara CRM).
• Individuals who correspond with the Client's users by email, chat, meetings or file sharing (Prismara Mail, Talk, Spaces, Work).
• Individuals whose activity is recorded in security telemetry from the Client's devices, identities, networks and applications (including visitors on guest networks where monitored).
• Any other individuals whose personal data the Client chooses to store or process using the Services.

C. Categories of personal data

• Identity and directory data: name, username, job title, department, manager, work contact details, profile photo, group memberships, authentication factors (stored as public keys or hashes), sign-in records.
• Device and technical data: device identifiers, hostnames, IP and MAC addresses, operating system and software inventory, configuration and compliance state, location data where the Client enables device location in Prismara Core.
• Security telemetry: process, file, registry, network, DNS, authentication, email and cloud audit events; alerts, incidents and investigation notes; file hashes and, where enabled, suspicious file samples; browsing and connection metadata routed through Prismara ZTNA or Prismara Browser policies.
• Content data: emails, attachments, chat messages, meeting recordings and transcripts (if enabled), documents, spreadsheets, presentations, files, calendar entries and vault items, as stored by users.
• Service management data: tickets, requests, change records, call notes and attachments submitted to Prismara Desk or SovSec support.
• Business records: CRM records, HR records (contract, pay grade, leave, performance, emergency contacts), ERP records (projects, timesheets, invoices, expenses).
• Test findings: personal data incidentally exposed during Prismara Crucible or manual penetration testing (for example usernames, email addresses, weak or leaked credentials).

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

D. Special categories and criminal offence data The Services are not designed to process special categories of personal data (Article 9 UK GDPR) or personal data relating to criminal convictions and offences (Article 10 UK GDPR). They may nevertheless be present in content the Client chooses to store — for example health information in an HR absence record or an email, or evidence of a possible offence identified during an incident investigation. Where present, they are protected by the measures in Annex II, including encryption at rest and role-based access. The Client should use Prismara Gov sensitivity labels and the Prismara HR restricted-field feature to limit access further and should tell SovSec in writing if it intends to process special categories at scale.

E. Processing operations, purpose and duration per Service Nature of processing for all Services: collection, storage, organisation, retrieval, consultation, analysis, transmission, restriction, backup and erasure, as necessary to provide, secure, support and maintain the Services. Frequency: continuous for the term. Duration: the term of the Agreement plus the exit and deletion periods in clause 12.

 Service                        Processing operations and purpose                                                            Where

 Prismara Identity & Admin      Directory, authentication (passkeys, MFA), single sign-on, tenant administration, audit      Vienna (AT)
                                logging, licence assignment.

 Prismara Mail, Talk, Spaces,   Hosting and delivery of email, chat, meetings, files and documents; spam and malware         Vienna (AT)
 Work                           filtering; search indexing; retention and legal hold as configured by the Client; sealed
                                storage with client-held keys where enabled.

 Prismara Prism (password       Storing end-to-end encrypted vault items. SovSec processes only encrypted blobs and          Vienna (AT)
 manager)                       account metadata; it cannot read vault contents.

 Prismara Core (UEM/MDM)        Device enrolment, configuration, compliance, patch and software deployment, remote           Vienna (AT); agent on
 and Reach (RMM)                support sessions initiated or approved under the Agreement, inventory.                       Client devices

 Prismara Endpoint, ZTNA,       Collection of endpoint and connection telemetry, policy enforcement, threat detection and    Vienna (AT); agents
 Browser                        response actions (isolation, quarantine).                                                    on Client devices

 Prismara SOC / MXDR            Ingestion and correlation of telemetry from Prismara products, detection, triage,            Vienna (AT); analysts
 (Prismara telemetry)           investigation, response actions authorised in the runbook, incident reporting. Prismara      in UK; EU partner
                                SOC processes Prismara telemetry only.                                                       SOC (planned 2028)

 Interim third-party EDR        Until Prismara Endpoint is generally available, endpoint telemetry processed by the          Per SOV-LG-004 (EU)
 (Secure / Sovereign plans)     European EDR vendor listed in SOV-LG-004 and monitored by SovSec.

 Microsoft tenant management    Administration of the Client Tenant through Microsoft Granular Delegated Admin Privileges    Client Tenant
 (Foundation / Secure /         (GDAP) from SovSec's dedicated administration tenant: user lifecycle, configuration,         (Microsoft, per Client's
 Sovereign) and MXDR in         Secure Score reviews, investigation and response in the Client's Defender XDR / Sentinel.    contract); access from
 Defender XDR / Sentinel        Client data stays in the Client Tenant; SovSec views and acts on it there and exports only   UK
                                what is needed for tickets or incident reports.

 Prismara Crucible and          Automated and manual security testing of in-scope systems under a written authorisation      Vienna (AT); test
 penetration testing            and rules of engagement; recording findings and evidence; minimising and redacting           origin as stated in
                                personal data in reports.                                                                    authorisation

 Prismara Desk and SovSec       Logging and handling of tickets, requests, incidents and changes; remote sessions;           Vienna (AT)
 support                        communications with requesters.

 Prismara Gov                   Data classification, data loss prevention, retention, eDiscovery and compliance reporting    Vienna (AT)
                                configured by the Client.

 Prismara CRM, HR, ERP          Hosting the Client's business records and workflows as configured by the Client.             Vienna (AT)

 Prismara Cloud                 Infrastructure hosting of Client workloads. SovSec does not access data inside Client        Austrian sovereign
                                workloads except to provide support the Client requests.                                     infrastructure (AT)

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

 Service                         Processing operations and purpose                                                               Where

 Professional services           Accessing, reviewing and transferring Client data as needed for the agreed scope; forensic      As stated in the
 (consulting, vCISO, incident    collection and analysis in incident response; migration of mailboxes and files into Prismara.   statement of work
 response, migration, CSR Bill
 readiness)

F. Competent supervisory authority The Information Commissioner's Office (ICO), unless the Client is subject to the EU GDPR for the processing, in which case the supervisory authority determined under that regulation.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

16. Annex II — Technical and organisational measures

The following measures apply to the Services SovSec hosts and operates. For Microsoft tenant management, the measures apply to SovSec's access to and actions in the Client Tenant; the security of the tenant itself is provided by Microsoft under the Client's own agreement and by the configuration the Client approves.

Area Measures

Governance Information security management system aligned to ISO/IEC 27001 (not certified), with policies, risk register, statement of applicability, internal audit and management review; named security owner (Founder); policies reviewed at least annually.

Encryption in TLS 1.3 for all external connections with hybrid post-quantum key exchange (X25519MLKEM768); HSTS on all web domains; transit legacy protocols disabled. Internal service-to-service traffic encrypted with mutual TLS.

Encryption at rest All production storage and backups encrypted with AES-256 (or an equivalent algorithm). Keys held in a dedicated key management service, separated from data, rotated on a defined schedule.

Client-held keys Where the product supports it — Prismara Mail sealed storage, Prismara Prism vaults, custodian-quorum recovery — content is encrypted with keys SovSec does not hold in usable form, so SovSec staff cannot read it.

Token and code Authentication tokens signed with a hybrid signature (ML-DSA-65 + ES256). Software builds reproducible where practical, integrity signed, and shipped with a software bill of materials (SBOM).

Tenant isolation Logical multi-tenancy with database row-level security (RLS) enforcing the tenant identifier on every query, separate encryption keys per tenant where supported, and automated tests that check for cross-tenant access.

Identity and Single sign-on for all staff; phishing-resistant MFA (FIDO2 / passkeys) mandatory for all administrative and production access; access least privilege; just-in-time elevation for production; quarterly access reviews; immediate revocation on leaving.

Microsoft Access to Client Tenants only through GDAP relationships with the least-privileged roles needed, time-bound and renewed with delegated access the Client's approval; no standing Global Administrator; SovSec administration tenant used for nothing else, with phishing- resistant MFA and Conditional Access; all actions logged in the Client Tenant's audit log.

Logging and Centralised, tamper-evident logging of administrative actions, authentication and security events, retained for at least 12 months; monitoring continuous monitoring of SovSec's own platform with Prismara SOC; alerting on anomalous staff access to client data.

Vulnerability Automated dependency and container scanning; patching of critical vulnerabilities within 72 hours and high within 14 days where management a fix is available; regular automated testing with Prismara Crucible and annual independent penetration test; coordinated vulnerability disclosure via security@sovsec.com; vulnerability handling and reporting as required by the Cyber Resilience Act.

Secure Secure development lifecycle with threat modelling, peer review of all changes, static analysis, secret scanning, protected development branches and separate development, test and production environments. Production data is not used for testing; demo environments use fictional data only.

Network security Default-deny firewalls, segmentation between management, application and data tiers; administrative interfaces reachable only through Prismara ZTNA; DDoS mitigation by the hosting provider.

Backups and Encrypted daily backups kept within the EU, retained for up to 35 days, with restore tests at least quarterly; documented resilience business continuity and disaster recovery plans tested at least annually.

Physical security Production servers hosted in netcup GmbH's Vienna, Austria data centre with access control, video surveillance, fire suppression, redundant power and cooling, as described in netcup's data processing agreement. SovSec staff have no physical access; failed disks are destroyed by the provider.

Personnel Confidentiality undertakings; background checks proportionate to role and permitted by law; onboarding and annual security and data protection training; disciplinary process for breaches.

Incident Documented incident response plan; 24×7 on-call for Sovereign-tier and platform incidents; customer notification as in clause 9; management post-incident reviews.

Data minimisation Telemetry collection limited to security-relevant fields; configurable retention per tenant; deletion and secure erasure processes and retention as in clause 12; pseudonymisation of analytics and service metrics.

Supplier Due diligence and written data protection terms for each Sub-processor; annual review of Sub-processors' security; EU hosting management required for any Sub-processor that stores Client Personal Data.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

Area Measures

Endpoints of Managed by Prismara Core with full-disk encryption, EDR, automatic updates and screen lock; client data is not stored locally SovSec staff except temporarily and encrypted, where needed for an investigation.

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

17. Annex III — Sub-processors

The Client authorises the Sub-processors listed in SOV-LG-004 (Sub-processor List), as updated in accordance with clause 7. At the date of this DPA the list includes:

  Sub-processor                     Purpose                                            Location    Status

  netcup GmbH (Germany)             Dedicated server hosting for all production        Vienna,     Current
                                    Services                                           Austria

  ESET or WithSecure (EU) —         Interim EDR for Secure / Sovereign plans           EU          Planned — from service launch
  one vendor, to be confirmed       until Prismara Endpoint GA

  [PARTNER SOC NAME] (EU)           24×7 monitoring cover for Sovereign plans          EU / EEA    Planned — 2028

  GitHub, Inc. (USA)                Source code hosting; no Client Personal            USA /       Current — to be replaced by EU-
                                    Data intended                                      global      hosted Git before general availability

  Stripe (personal tiers only)      Payment processing for Prismara Personal;          EU / UK     Planned — at paid launch
                                    not used for business Client Personal Data

The current version of the Sub-processor List is available on request from privacy@sovsec.com and will be published at sovsec.com/legal.

18. Signatures

Signed by the authorised representatives of the parties. Where the Agreement is accepted electronically, this DPA is accepted with it and no separate signature is needed.

For the Client (controller) For SovSec Ltd (processor)

Name: Name: Jake Gliddon Title: Title: Founder and Director Date: Date: Signature: Signature:

S O V S E C · D ATA P R O C E S S I N G A G R E E M E N T SOV-LG-003 · v1.0 · UK

Drafting notes — remove before publication

• Placeholders: [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [PARTNER SOC NAME].
• Cross-reference the master services agreement and online terms by their final document IDs once fixed; confirm the 'Agreement' definition matches.
• Confirm the Annex II figures reflect actual operations before publication (patch windows 72 h / 14 d, backup retention 35 days, log retention 12 months, quarterly restore tests and access reviews, AES-256).
• Confirm the exit/deletion timeline (30 + 30 days, backups ≤35 days) and its interaction with the Data Act switching terms in the Agreement.
• Commercial decision: whether to offer a separate (higher) liability cap for data protection breaches; currently the Agreement cap applies.
• Breach notice target 24 h / maximum 48 h is stricter than many market DPAs — confirm it can be met operationally, including weekends for Foundation tier clients.
• Verified 2 Nov 2026: the European Commission renewed the UK adequacy decisions in December 2025, running to 27 December 2031. The UK's own recognition of EEA states as adequate should be confirmed by the solicitor in the form now in force after the Data (Use and Access) Act 2025.
• Solicitor to confirm the UK Addendum / IDTA elections in clause 10.4 and whether the current ICO versions are still the latest.

End of SOV-LG-003 Data Processing Agreement v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].