Data Processing Addendum

1. Scope and Roles

This Data Processing Addendum ("DPA") is between Customer and Biqli LLC and forms part of the agreement for the Services. It applies to Personal Data contained in Customer Content that Biqli processes on Customer's behalf ("Customer Personal Data").

Customer is a controller or business, and Biqli is its processor or service provider. If Customer acts as a processor for another controller, Biqli is Customer's subprocessor. Each party will comply with Data Protection Laws applicable to its role.

Biqli acts as an independent controller, not Customer's processor, for Account administration, direct billing records, fraud and abuse prevention, security logs, product telemetry that does not identify Customer data subjects, legal compliance, and establishment or defense of claims. That processing is governed by the Privacy Policy.

2. Definitions

"Data Protection Laws" means laws applicable to the processing, including the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection, and United States state privacy laws such as the California Consumer Privacy Act ("CCPA"). "Personal Data," "process," "controller," "processor," "business," "service provider," and "Data Subject" have the meanings in applicable Data Protection Laws. "Security Incident" means unauthorized acquisition of, access to, alteration, disclosure, loss, or destruction of Customer Personal Data, excluding unsuccessful attempts that do not compromise security.

3. Instructions and Compliance

Biqli will process Customer Personal Data only on documented instructions from Customer, including the agreement, Customer's configurations and use of the Services, and written instructions consistent with the agreement. Biqli may process otherwise if required by law and, unless prohibited, will notify Customer before doing so.

Biqli will promptly inform Customer if, in its reasonable opinion, an instruction violates Data Protection Laws and may suspend the affected processing until the parties resolve the issue. Customer is responsible for the lawfulness, fairness, accuracy, and transparency of its collection and instructions, including notices, consents, and legal bases.

4. Annex I - Processing Details

Parties. The data exporter is Customer, in its capacity as controller or processor, at the legal address identified in the Account or Order Form; its key contact is the billing or signer contact identified there. The data importer is Biqli LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA, contact@biq.li, in its capacity as processor or subprocessor. Each party's activities are the activities described in the agreement, and acceptance or signature of the agreement is signature of this DPA and the incorporated transfer clauses.

• Subject matter: providing link management, QR codes, biolinks, analytics, workspaces, integrations, APIs, support, security, and related Enterprise Services.
• Duration: the applicable service term plus the deletion and backup-retention periods in this DPA.
• Nature and purpose: hosting, organizing, transmitting, redirecting, measuring, securing, supporting, and deleting data as configured by Customer.
• Data Subjects: Customer's users, personnel, customers, prospects, website visitors, link visitors, and other individuals whose data Customer submits or measures.
• Personal Data: names, business contact details, Account and workspace identifiers, IP address, device and browser data, URLs and URL parameters, click and conversion events, approximate location derived from IP, integration data, support content, and any other Personal Data Customer chooses to submit.
• Sensitive data: the Services are not designed for special-category, highly sensitive, health, payment-card, government-identifier, or children's data. Customer must not submit such data unless the parties expressly agree in writing and implement appropriate safeguards.
• Frequency: continuous or as initiated and configured by Customer.
• Retention: for the service term and deletion periods in Section 11, subject to Customer's configured analytics-retention period and legal retention.

Supervisory authority. The competent authority is determined under Clause 13 of the EU SCCs. Where the clauses require the parties to identify an EEA authority and no other authority is mandated, the Irish Data Protection Commission will be the competent authority.

5. Confidentiality and Personnel

Biqli will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive appropriate privacy and security training, and access data only as necessary for their duties. Biqli remains responsible for their compliance with this DPA.

6. Annex II - Technical and Organizational Measures

Taking into account the state of the art, implementation cost, and the nature, scope, context, purpose, and risk of processing, Biqli will maintain measures designed to protect Customer Personal Data, including:

• encryption in transit using current TLS and encryption at rest where supported and appropriate;
• role-based and least-privilege access, unique credentials, multi-factor authentication for privileged systems where supported, and periodic access review;
• logical tenant separation and controls designed to prevent unauthorized cross-workspace access;
• secure development practices, dependency and vulnerability management, code review, and change controls;
• network, application, abuse, and security monitoring with protected audit logs;
• backups, restoration procedures, business-continuity planning, and periodic recovery testing proportionate to the Services;
• incident-response procedures covering detection, containment, investigation, remediation, and notification;
• subprocessor diligence and written data-protection obligations; and
• secure deletion or irreversible anonymization when data is no longer required.

Biqli may update these measures without materially reducing the overall security of the Services during a paid term.

7. Annex III - Subprocessors

Customer gives general written authorization for Biqli to use the subprocessors listed at biq.li/subprocessors. Biqli will impose data-protection obligations that provide materially equivalent protection and remains responsible for each subprocessor's performance of those obligations.

The approved-provider table is incorporated as Annex III and identifies each provider's name, purpose, categories of data, and processing location. A listed provider becomes a subprocessor only when it processes Customer Personal Data for the relevant enabled Service. For each subprocessor, the subject matter and nature of processing are limited to the stated purpose, and the duration is the period the subprocessor provides the relevant Service plus the deletion period applicable under Sections 4 and 11.

Biqli will give at least 30 days notice before a new subprocessor begins materially processing Customer Personal Data. If an immediate replacement is reasonably required to avoid material security, continuity, or legal harm and advance notice is not reasonably possible, Biqli will give notice without undue delay, explain the reason, and preserve Customer's objection rights. Customer may object on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, Customer may terminate the affected Service and receive a refund of prepaid recurring Fees for the unused terminated period.

8. Data Subject Requests

Taking into account the nature of processing, Biqli will provide reasonable technical and organizational assistance so Customer can respond to requests to access, correct, delete, restrict, object to, or port Customer Personal Data. If Biqli receives a request relating to Customer Personal Data, it will direct the requester to Customer and will not independently respond except on Customer's documented instruction or as required by law.

9. Security Incidents

Biqli will notify Customer without undue delay after confirming a Security Incident and will provide available information reasonably needed for Customer's legal obligations, including the nature of the incident, likely consequences, affected data and Data Subjects, mitigation, and a contact point. Information may be provided in phases as the investigation progresses.

Biqli will promptly contain, investigate, mitigate, and remediate a Security Incident and reasonably cooperate with Customer. Notification is not an admission of fault or liability. Customer is responsible for notifications to regulators and Data Subjects unless law assigns that duty to Biqli.

10. Compliance Assistance

Taking into account the nature of processing and information available to Biqli, Biqli will reasonably assist Customer with security obligations, breach assessments, data-protection impact assessments, and prior consultation with regulators under Articles 32 through 36 of the EU GDPR or equivalent laws. Any material out-of-scope assistance may be subject to mutually agreed reasonable Fees.

11. Return and Deletion

During the service term, Customer may export Customer Personal Data through available product functionality. At Customer's written choice, Biqli will return or delete Customer Personal Data after the Services end and delete remaining copies, unless applicable law requires retention. Unless law requires retention, Biqli will delete Customer Personal Data from active systems within 30 days after termination, Account deletion, or Customer's valid instruction.

Residual encrypted copies may remain in access-restricted backups until overwritten in the ordinary cycle, generally within 90 days. During that period Biqli will not restore or process the data except for disaster recovery, security, or legal compliance, and will delete restored data consistent with this section. Biqli may retain limited records required by law, provided they remain protected and isolated from ordinary use.

12. Audits and Records

Biqli will make available information reasonably necessary to demonstrate compliance, including relevant policies, summaries, and independent assessment reports when available. No more than once annually, unless required by a regulator, following a Security Incident, or where Customer has reasonable evidence of material noncompliance, Customer may request a reasonable audit, including an inspection where required by Data Protection Laws.

Audits must be coordinated in advance, occur during normal business hours, avoid unreasonable disruption, protect other customers and Biqli Confidential Information, and be performed by Customer or a qualified independent auditor bound by confidentiality. Customer bears its audit costs unless the audit identifies a material breach by Biqli. Current independent reports may satisfy a request to the extent they reasonably address it; Biqli will reasonably cooperate with a proportionate supplemental review where they do not.

13. United States State Privacy Terms

For Customer Personal Data subject to the CCPA, Biqli is a service provider or contractor. Biqli will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship or for a commercial purpose other than the business purposes specified in this DPA; or combine it with Personal Data received from another person or collected from Biqli's own interaction with a consumer, except as permitted by the CCPA.

Biqli certifies that it understands these restrictions and will comply with them. Biqli will provide the same level of privacy protection required of Customer by applicable CCPA provisions, notify Customer if Biqli determines it can no longer meet its obligations, permit Customer to take reasonable and appropriate steps to verify compliance, and cooperate with reasonable remediation steps. Customer may monitor compliance through the audit rights in Section 12.

14. International Transfers

Where Customer Personal Data is transferred from the EEA to a country without an applicable adequacy decision, the parties incorporate the European Commission Standard Contractual Clauses issued under Decision 2021/914. Module Two applies when Customer is a controller and Biqli is a processor; Module Three applies when Customer is a processor and Biqli is a subprocessor. Clause 7 (docking) applies. Under Clause 9(a), Option 2 general written authorization applies with the notice period in Section 7. The optional language in Clause 11 does not apply. Under Clause 17, Option 1 applies and Irish law governs; under Clause 18(b), the courts of Ireland are selected, in each case unless Data Protection Laws require another selection.

For restricted transfers under UK Data Protection Laws, the parties incorporate Part 2: Mandatory Clauses of the Approved Addendum, being template Addendum B.1.0 issued by the UK Information Commissioner's Office and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses. The applicable EU SCC module and selections above complete Table 2; Sections 4, 6, and 7 complete Table 3; Customer and Biqli are the exporter and importer identified in Section 4 for Table 1; and neither party may end the Addendum solely because the ICO issues a revised Approved Addendum under Table 4. England and Wales is the selected law and forum unless UK Data Protection Laws require otherwise.

For Swiss transfers, the EU SCCs apply with references adapted to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as competent authority, and Switzerland as an available forum where required.

The parties will reasonably cooperate on transfer risk assessments and supplementary measures. The processing details in Section 4, security measures in Section 6, and subprocessors identified under Section 7 complete the relevant SCC annexes. The SCCs and UK Addendum control over conflicting terms for the applicable restricted transfer.

15. Liability, Conflict, and Duration

The liability provisions in the Terms apply to this DPA except where Data Protection Laws or the SCCs prohibit limitation. If this DPA conflicts with the rest of the agreement regarding Customer Personal Data, this DPA controls; the SCCs or UK Addendum control for their applicable transfers.

This DPA begins when Biqli first processes Customer Personal Data and continues until Biqli has deleted it in accordance with Section 11. The version incorporated into an Enterprise Order Form remains fixed for that Order Form's term unless the parties sign an amendment. Mandatory changes in Data Protection Laws apply as required, and the parties will cooperate in good faith on any conforming amendment.