Business Terms of Service

1. Scope and Roles

1.1 Application. This DPA applies whenever Ortalio processes Personal Data contained within Customer Data (including End Customer Data) on behalf of Customer in the course of providing the Service.

1.2 Roles. Customer is the Controller (or "Business" under U.S. privacy laws, or processor acting on behalf of a third-party controller) and Ortalio is the Processor (or "Service Provider" / "Operator"). Customer is solely responsible for the accuracy, quality, and lawfulness of Personal Data submitted to the Service and the means by which Customer acquired it.

2. Processor Obligations (Article 28 GDPR / UK GDPR / LGPD / Law 25 / U.S. State Laws)

2.1 Documented Instructions. Ortalio shall process Personal Data within Customer Data only on Customer’s documented instructions—as set forth in the Terms, this DPA, and Customer’s configuration and use of the Service—unless required to do so by applicable law, in which case Ortalio shall inform Customer of that legal requirement before processing (unless the law prohibits such notice on important grounds of public interest).

2.2 U.S. State Privacy Law Service Provider Terms. With respect to Personal Data subject to the California Consumer Privacy Act (CCPA) or equivalent U.S. state privacy statutes, Ortalio acts as a "Service Provider" and certifies that it will not: (a) "sell" or "share" (for cross-context behavioral advertising) such Personal Data; (b) retain, use, or disclose such Personal Data for any purpose other than the business purposes specified in the Terms and this DPA or as otherwise permitted by law; (c) retain, use, or disclose such Personal Data outside the direct business relationship between Ortalio and Customer; or (d) combine such Personal Data with personal data received from other sources except as permitted by law to perform the Service. Ortalio will notify Customer if it determines it can no longer meet its obligations under applicable U.S. state privacy laws.

2.3 Confidentiality of Personnel. Ortalio ensures that all personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.4 Security of Processing. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, Ortalio implements and maintains the technical and organizational security measures described in Annex II below to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data ("Personal Data Breach").

2.5 Subprocessors.

1. General Authorization: Customer grants Ortalio general written authorization to engage the subprocessors listed in Annex III below.
2. Subprocessor Obligations: Ortalio enters into a written agreement with each subprocessor imposing data protection obligations substantively equivalent to those in this DPA and remains fully liable to Customer for the performance of each subprocessor’s data protection obligations.
3. Notice and Objection: Ortalio will provide Customer with advance notice (via email or in-app notice at least 15 days prior where practicable) before authorizing any new subprocessor to process Personal Data. Customer may object on reasonable data protection grounds within ten (10) days of notice by contacting privacy@ortalio.com. If Ortalio cannot reasonably accommodate the objection, Customer may terminate the affected subscription and receive a pro-rata refund of prepaid, unused subscription fees.

2.6 Assistance with Data Subject Requests and Impact Assessments. Taking into account the nature of the processing, Ortalio will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligations to respond to data subject rights requests. If a data subject submits a request directly to Ortalio naming Customer, Ortalio will promptly forward the request to Customer. Ortalio will also provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities where required under applicable data protection law, solely in relation to processing carried out by Ortalio.

2.7 Personal Data Breach Notification. Ortalio shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. Where all relevant information is not available at the same time, Ortalio may provide the information in phases without undue further delay.

2.8 Return and Deletion of Data. Upon termination of the Service, Ortalio shall make Customer Data available for export during the post-termination read-only window and subsequently delete Customer Data from active systems and backups in accordance with Section 12.3 of the Terms, unless applicable law requires storage of specific records.

2.9 Audits and Inspections (Article 28(3)(h)). Ortalio shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, subject to the following procedures:

1. Customer shall first review Ortalio’s available security documentation and compliance summaries provided upon written request;
2. Where an additional audit or inspection is required by law, a supervisory authority, or following a Personal Data Breach affecting Customer Data (or no more than once per year on at least 30 days' advance written notice), the audit shall be conducted during normal business hours, under strict confidentiality obligations, in a manner that does not disrupt Ortalio’s operations or compromise other customers’ data, and at Customer’s expense.

3. International Data Transfers

3.1 EEA Transfers (EU Standard Contractual Clauses). Where the transfer of Personal Data from Customer to Ortalio is subject to the EU GDPR and requires a transfer safeguard, the parties hereby enter into and incorporate by reference the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"), completed as follows:

• Module: Module Two (Controller to Processor) applies where Customer is a Controller, and Module Three (Processor to Processor) applies where Customer acts as a Processor for an End Customer.
• Clause 7 (Docking Clause): Included.
• Clause 9(a) (Use of Sub-processors): Option 2 (General written authorization) applies, with a notice period of 15 days.
• Clause 11 (Redress): The optional language does not apply.
• Clause 17 (Governing Law): Option 1 applies; the EU SCCs are governed by the laws of Ireland.
• Clause 18(b) (Choice of Forum and Jurisdiction): Disputes arising from the EU SCCs shall be resolved by the courts of Ireland.
• Annexes I, II, and III: Completed as set out in Annex I, Annex II, and Annex III of this Schedule 1. Electronic acceptance of the Terms constitutes execution of Annex I by both parties.

3.2 United Kingdom Transfers (ICO International Data Transfer Addendum). Where the transfer of Personal Data from Customer to Ortalio is subject to the UK GDPR, the parties hereby enter into and incorporate the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, issued by the UK Information Commissioner and in force 21 March 2022 ("UK Addendum"), completed in Annex IV below.

3.3 Brazilian Transfers (LGPD Article 33 & ANPD Resolution No. 19/2024). Where Customer transfers Personal Data subject to the Brazilian Lei Geral de Proteção de Dados (Law No. 13.709/2018 – "LGPD") to Ortalio outside Brazil, such transfer is governed by the processor security, confidentiality, and instruction obligations in this DPA and the Brazilian Standard Contractual Clauses approved by the Autoridade Nacional de Proteção de Dados under Resolution CD/ANPD No. 19, of August 23, 2024 (Annex II), set out in English in Annex V below and in their authoritative unmodified Portuguese text in Annex V of the Brazilian Portuguese (pt-br) version of these Terms (accessible at any time via the pt-br language selector on the Terms page), which are executed by both parties upon Customer’s electronic acceptance of these Terms.

ANNEX I TO SCHEDULE 1 — Description of Processing and Transfer

A. List of Parties

• Data Exporter (Customer):
  • Name, Address, and Contact Person: The business entity name, address, and primary administrator contact details registered in Customer’s Ortalio account and Order.
  • Activities Relevant to the Data Transferred: Use of the Ortalio B2B field-service software platform to manage trade operations, schedules, estimates, invoices, and customer records.
  • Role: Controller (or Processor where acting for an End Customer).
  • Signature and Date: Deemed signed and dated upon Customer’s electronic acceptance of the Ortalio Business Terms of Service.
• Data Importer (Ortalio):
  • Name: SendWork, Inc.
  • Address: 382 NE 191st Street, Suite 42012, Miami, FL 33179, United States
  • Contact Details: Privacy Team — privacy@ortalio.com
  • Activities Relevant to the Data Transferred: Cloud hosting, storage, maintenance, support, and processing of Customer Data within the Ortalio SaaS platform in accordance with Customer’s instructions.
  • Role: Processor.
  • Signature and Date: Deemed signed and dated upon Customer’s electronic acceptance of the Ortalio Business Terms of Service.

B. Description of Transfer

• Categories of Data Subjects: Customer’s End Customers (homeowners, property contacts, commercial clients), prospective clients/leads, and Customer’s employees, technicians, and subcontractors.
• Categories of Personal Data Transferred: Names, email addresses, phone numbers, billing and service site addresses, job schedules, tasks, estimates, quotes, invoices, payment statuses, work notes, site photos/attachments, signatures, and voice recordings/transcripts submitted by Customer.
• Sensitive Data Transferred (if applicable): None intended; Customer is prohibited under Section 9.2 of the Terms from submitting special categories of data or high-risk sensitive data into unrestricted fields.
• Frequency of the Transfer: Continuous throughout Customer’s use of the Service.
• Nature of the Processing: Collection, cloud hosting, storage, organization, search, AI-assisted drafting/transcription at Customer’s initiation, transmission of Customer-directed emails, backup, and deletion.
• Purpose(s) of the Data Transfer and Further Processing: To provide, secure, and support the Service for Customer under the Terms.
• Period for Which the Personal Data Will Be Retained: For the duration of the subscription or trial term plus the post-termination export and deletion lifecycle specified in Section 12.3 of the Terms.
• For Transfers to Subprocessors: The subject matter, nature, and duration of processing by subprocessors are set out in Annex III below.

C. Competent Supervisory Authority (Clause 13(a) of the EU SCCs)

In accordance with Clause 13(a) of the EU SCCs, the competent supervisory authority is determined as follows:

1. Where the Data Exporter is established in an EU/EEA Member State: The supervisory authority with responsibility for ensuring compliance by the Data Exporter with Regulation (EU) 2016/679 as regards the data transfer in the EU/EEA Member State in which the Data Exporter is established (for example, the Data Protection Commission of Ireland where the Data Exporter is established in Ireland, the CNIL in France, the AEPD in Spain, or the CNPD in Portugal).
2. Where the Data Exporter is not established in an EU/EEA Member State, but falls within the territorial scope of Article 3(2) of Regulation (EU) 2016/679 and has appointed a representative pursuant to Article 27(1): The supervisory authority of the EU/EEA Member State in which that representative within the meaning of Article 27(1) is established.
3. Where the Data Exporter is not established in an EU/EEA Member State, falls within the territorial scope of Article 3(2) of Regulation (EU) 2016/679, but is not required to appoint a representative pursuant to Article 27(2): The supervisory authority of one of the EU/EEA Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

ANNEX II TO SCHEDULE 1 — Technical and Organizational Security Measures

Ortalio implements and maintains the following technical and organizational security measures:

1. Encryption in Transit and at Rest: Personal Data transmitted over public networks is encrypted using TLS 1.2 or higher. Personal Data stored in managed cloud databases and object storage is encrypted at rest.
2. Logical Multi-Tenant Isolation: Customer workspaces are logically isolated in the database using row-level security (RLS) policies and workspace-scoped authentication tokens.
3. Access Control and Authentication: Access to Customer workspaces is controlled by user authentication and role-based permissions configured by Customer. Internal Ortalio engineering access to production infrastructure is restricted on a least-privilege basis and requires multi-factor authentication.
4. Payment Data Separation: Ortalio does not store raw payment card numbers or CVV codes; card collection occurs on PCI-DSS compliant Stripe-hosted checkout pages.
5. Resilience, Backups, and Incident Management: Production databases are backed up regularly to support availability and disaster recovery. Application errors are monitored for stability, and Ortalio maintains an incident response procedure to investigate and notify Customers of Personal Data Breaches.
6. Subprocessor Governance: Ortalio conducts pre-engagement reviews of third-party infrastructure subprocessors and binds them to written data protection and security terms.

ANNEX III TO SCHEDULE 1 — Authorized Subprocessor List

Customer authorizes the following subprocessors. Providers marked as "Feature-Specific / Approved Route" receive Personal Data only when the corresponding feature, model route, or integration is active and invoked for Customer’s workspace:

ANNEX IV TO SCHEDULE 1 — UK International Data Transfer Addendum (Tables 1 to 4 & Part 2)

• Table 1 (Parties): Start Date is the date Customer accepts the Terms. The Exporter and Importer details and key contacts are set out in Annex I.A above.
• Table 2 (Selected SCCs, Modules and Selected Clauses): The Approved EU SCCs (Commission Decision (EU) 2021/914), including the Appendix Information and with only the modules, clauses, and optional provisions selected in Section 3.1 of this Schedule 1.
• Table 3 (Appendix Information): Annex 1A (List of Parties): Annex I.A above. Annex 1B (Description of Transfer): Annex I.B above. Annex II (Technical and organisational measures): Annex II above. Annex III (List of Sub-processors): Annex III above.
• Table 4 (Ending this Addendum when the Approved Addendum Changes): Both Importer and Exporter may end this Addendum as set out in Section 19 of the Approved Addendum.
• Part 2 (Mandatory Clauses): Alternative Part 2 Mandatory Clauses: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

ANNEX V TO SCHEDULE 1 — Brazilian Standard Contractual Clauses (ANPD Resolution CD/ANPD No. 19/2024, Annex II)

(Note: Below are the Brazilian Standard Contractual Clauses approved in Annex II of Resolution CD/ANPD No. 19, of August 23, 2024, as amended by the Rectification of August 18, 2025, in the ANPD’s own English version, with Sections I, III, and IV completed by the Parties in the spaces provided. Section II (Clauses 5 to 24) is reproduced in full and without any change. For transfers subject to the Brazilian LGPD, the authoritative Portuguese text published in the Diário Oficial da União, which appears in Annex V of the Brazilian Portuguese (pt-br) version of these Terms—accessible via the pt-br language selector on the Terms page—governs in the event of any linguistic discrepancy.)

SECTION I – GENERAL INFORMATION

CLAUSE 1. Identification of the Parties

1.1. By this agreement, the Exporter and the Importer (hereinafter, "Parties"), identified below, have agreed to these standard contractual clauses (hereinafter, "Clauses") approved by the National Data Protection Authority (ANPD), to govern the International Data Transfer described in CLAUSE 2, in accordance with the provisions of the National Legislation.

• Exporter: [X] Exporter/Controller | [ ] Exporter/Processor (or Processor when acting on behalf of a third-party Controller).
  • Name: The business or professional customer entity ("Customer") identified in the Ortalio account registration and Order.
  • Qualification: The legal entity or professional named in the Ortalio account registration, represented by its registered administrator.
  • Main Address: The business address recorded in the Customer’s Ortalio account.
  • E-mail Address: The account administrator’s email address recorded in the Customer’s Ortalio account.
  • Contact for the Data Subject: The privacy or customer contact channel published by the Customer.
  • Other information: The Customer accepts these Clauses electronically when it accepts the Ortalio Business Terms of Service.
• Importer: [ ] Importer/Controller | [X] Importer/Processor
  • Name: SendWork, Inc.
  • Qualification: A corporation organized under the laws of the State of Florida, United States of America.
  • Main Address: 382 NE 191st Street, Suite 42012, Miami, FL 33179, United States.
  • E-mail Address: privacy@ortalio.com
  • Contact for the Data Subject: privacy@ortalio.com
  • Other information: Ortalio acts strictly as Processor on the Exporter’s instructions under Schedule 1 (Data Processing Addendum) of these Terms.

CLAUSE 2. Object

2.1 This Clauses shall apply to International Transfers of Personal Data between Data Exporters and Data Importers, as described below.

• Description of the international data transfer: Transfer to the Importer of the personal data that the Exporter and its Authorized Users enter into, generate in, or synchronize with the Exporter’s Ortalio workspace. Categories of data subjects: the Exporter’s End Customers, property/site contacts, prospective leads, and authorized employees/technicians of the Exporter.
• Main purposes of the transfer: Provision, cloud hosting, storage, synchronization, technical support, security, and operational processing of the Ortalio field-service management software platform ("Service") in accordance with the Exporter’s instructions under the Ortalio Business Terms of Service.
• Categories of personal data transferred: Contact and registration data (names, emails, phone numbers, business and service site addresses), schedules, tasks, estimates, invoices, payment statuses, work notes, site photos/attachments, signatures, and voice recordings/transcripts submitted by the Exporter. (Sensitive personal data is not intended to be transferred, and its submission in unrestricted fields is prohibited under Section 9.2 of the Terms).
• Period of data storage: For the duration of the Exporter’s active subscription or free trial period, plus the read-only export window (ordinarily 30 days) and the standard active database deletion and encrypted backup overwrite lifecycle set forth in Section 12.3 of the Terms, unless retention is required by law.
• Other information: Transfers occur continuously during the Exporter’s use of the Service, with primary processing located in the United States.

CLAUSE 3. Onward Transfers

3.1. (Option B) The Importer may carry out an Onward Transfer of Personal Data subject to the International Data Transfer governed by these Clauses, in the cases and according to the conditions described below and the provisions of CLAUSE 18.

• Main purposes of the transfer: Cloud application and database hosting, transactional email delivery, error monitoring, product analytics, security, and AI/voice feature processing (when invoked by the Exporter) through the authorized subprocessors listed in Annex III to Schedule 1.
• Categories of personal data transferred: The categories specified in Clause 2.1, limited to the data each subprocessor needs for its purpose.
• Period of data storage: The period specified in Clause 2.1.
• Other information: Each subprocessor is bound by a written contract to the safeguards of these Clauses, as required by Clause 18.2.

CLAUSE 4. Responsibilities of the Parties

4.1 (Option A) Without prejudice to the duty of mutual assistance and the general obligations of the Parties, the Designated Party below, as Controller, shall be responsible for complying with the following obligations set out in these Clauses:

a) Responsible for publishing the document provided in CLAUSE 14; [X] Exporter [ ] Importer

b) Responsible for responding to requests from Data Subjects dealt with in CLAUSE 15: [X] Exporter [ ] Importer

c) Responsible for notifying the security incident provided in CLAUSE 16: [X] Exporter [ ] Importer

4.2. For the purposes of these Clauses, if the Designated Party pursuant to item 4.1. is the Processor, the Controller remains responsible for:

a) compliance with the obligations provided in CLAUSES 14, 15 and 16 and other provisions established in the National Legislation, especially in case of omission or non-compliance with the obligations by the Designated Party;

b) compliance with ANPD's determinations; and

c) guaranteeing the Data Subjects' rights and repairing damages caused, subject to the provisions of Clause 17.

SECTION II – MANDATORY CLAUSES

CLAUSE 5. Purpose

5.1 These Clauses are presented as a mechanism to enable the secure international flow of personal data, establish minimum guarantees and valid conditions for carrying out the International Data Transfer and aim to guarantee the adoption of adequate safeguards for compliance with the principles, the rights of the Data Subject and the data protection regime provided for in National Legislation.

CLAUSE 6. Definitions

6.1 For the purposes of these Clauses, the definitions in art. 5 of LGPD, and art. 3 of the Regulation on the International Transfer of Personal Data shall be considered, without prejudice to other normative acts issued by ANPD. The Parties also agree to consider the terms and their respective meanings as set out below:

a) Processing agents: the controller and the processor;

b) ANPD: National Data Protection Authority;

c) Clauses: the standard contractual clauses approved by ANPD, which are part of SECTIONS I, II and III;

d) Related Contract: contractual instrument signed between the Parties or, at least, between one of them and a third-party, including a Third-Party Controller, which has a common purpose, link or dependency relationship with the contract that governs the International Data Transfer;

e) Controller: Party or third-party ("Third Controller") responsible for decisions regarding the processing of Personal Data;

f) Personal Data: information related to an identified or identifiable natural person;

g) Sensitive Personal Data: personal data on racial or ethnic origin, religious belief, political opinion, affiliation to trade unions or to a religious, philosophical or political organization, data regarding health or sexual life, genetic or biometric data, whenever related to a natural person;

h) Erasure: exclusion of data or dataset from a database, regardless of the procedure used;

i) Exporter: processing agent, located in the national territory or in a foreign country, who transfers personal data to the Importer;

j) Importer: processing agent, located in a foreign country, who receives personal data from the Exporter;

k) National Legislation: set of Brazilian constitutional, legal and regulatory provisions regarding the protection of Personal Data, including the LGPD, the International Data Transfer Regulation and other normative acts issued by ANPD;

l) Arbitration Law: Law No. 9,307, of September 23, 1996;

m) Security Measures: technical and administrative measures able to protect Personal Data from unauthorized access and from accidental or unlawful events of destruction, loss, alteration, communication or dissemination;

n) Research Body: body or entity of the government bodies or associated entities or a non-profit private legal entity legally established under Brazilian laws, having their headquarter and jurisdiction in the Brazilian territory, which includes basic or applied research of historical, scientific, technological or statistical nature in its institutional mission or in its corporate or statutory purposes;

o) Processor: Party or third-party, including a Sub-processor, which processes Personal Data on behalf of the Controller;

p) Designated Party: Party or a Third-Party Controller, under the terms of CLAUSE 4, designated to fulfill specific obligations regarding transparency, Data Subjects' rights and notifying security incidents;

q) Parties: Exporter and Importer;

r) Access Request: request for mandatory compliance, by force of law, regulation or determination of public authority, to grant access to the Personal Data subject to the International Data Transfer governed by these Clauses;

s) Sub-processor: processing agent hired by the Importer, with no link with the Exporter, to process Personal Data after an International Data Transfer;

t) Third-Party Controller: Personal Data Controller who authorizes and provides written instructions for the carrying out of the International Data Transfer between Processors governed by these Clauses, on his behalf, pursuant to Clause 4 ("Option B");

u) Data Subject: natural person to whom the Personal Data which are subject to the International Data Transfer governed by these Clauses relate;

v) Transfer: processing modality through which a processing agent transmits, shares or provides access to Personal Data to another processing agent;

w) International Data Transfer: transfer of Personal Data to a foreign country or to an international organization which Brazil is a member of; and

x) Onward Transfer: transfer of Personal Data, within the same country or to another country, by an Importer to a third-party, including a Sub-processor, provided that it does not constitute an Access Request.

CLAUSE 7. Applicable legislation and ANPD supervision

7.1. The International Data Transfer subject to these Clauses shall subject to the National Legislation and to the supervision of ANPD, including the power to apply preventive measures and administrative sanctions to both Parties, as appropriate, as well as the power to limit, suspend or prohibit the international transfers arising from this agreement or a Related Contract.

CLAUSE 8. Interpretation

8.1. Any application of these Clauses shall occur in accordance with the following terms:

a) these Clauses shall always be interpreted more favorably to the Data Subject and in accordance with the provisions of the National Legislation;

b) in case of doubt about the meaning of any term in these Clauses, the meaning which is most in line with the National Legislation shall apply;

c) no item in these Clauses, including a Related Agreement and the provisions set forth in SECTION IV, shall be interpreted as limiting or excluding the liability of any of the Parties in relation to obligations set forth in the National Legislation; and

d) provisions of SECTIONS I and II shall prevail in case of conflict of interpretation with additional clauses and other provisions set forth in SECTIONS III and IV of this agreement or in Related Agreements.

CLAUSE 9. Docking Clause

9.1. By mutual agreement between the Parties, it shall be possible for a processing agent to adhere to these Clauses, either as a Data Exporter or as a Data Importer, by completing and signing a written document, which shall form part of this contract.

9.2 The acceding party shall have the same rights and obligations as the originating parties, according to the position assumed of Exporter or Importer and according to the corresponding category of processing agent.

CLAUSE 10. General obligations of the Parties

10.1. The Parties undertake to adopt and, when necessary, demonstrate the implementation of effective measures capable of demonstrating observance of and compliance with the provisions of these Clauses and the National Legislation, as well as with the effectiveness of such measures and, in particular:

a) use the Personal Data only for the specific purposes described in CLAUSE 2, with no possibility of subsequent processing incompatible with such purposes, subject to the limitations, guarantees and safeguards provided for in these Clauses;

b) guarantee the compatibility of the processing with the purposes informed to the Data Subject, according to the processing activity context;

c) limit the processing activity to the minimum required for the accomplishment of its purposes, encompassing pertinent, proportional and non-excessive data in relation to the Personal Data processing purposes;

d) guarantee to the Data Subjects, subject to the provisions of Clause 4:

(d.1.) clear, accurate and easily accessible information on the processing activities and the respective processing agents, with due regard for trade and industrial secrecy;

(d.2.) facilitated and free of charge consultation on the form and duration of the processing, as well as on the integrity of their Personal Data; and

(d.3.) accuracy, clarity, relevance and updating of the Personal Data, according to the necessity and for compliance with the purpose of their processing;

e) adopt the appropriate security measures compatible with the risks involved in the International Data Transfer governed by these Clauses;

f) not to process Personal Data for abusive or unlawful discriminatory purposes;

g) ensure that any person acting under their authority, including sub-processors or any agent who collaborates with them, whether for reward or free of charge, only processes data in compliance with their instructions and with the provisions of these Clauses;

h) keep a record of the Personal Data processing operations of the International Data Transfer governed by these Clauses, and submit the relevant documentation to ANPD, when requested.

CLAUSE 11. Sensitive personal data

11.1. If the International Data Transfer involves Sensitive Personal Data, the Parties shall apply additional safeguards, including specific Security Measures which are proportional to the risks of the processing activity, to the specific nature of the data and to the interests, rights and guarantees to be protected, as described in SECTION III.

CLAUSE 12. Personal data of children and adolescents

12.1. In case the International Data Transfer governed by these Clauses involves Personal Data concerning children and adolescents, the Parties shall implement measures to ensure that the processing is carried out in their best interest, under the terms of the National Legislation and relevant instruments of international law.

CLAUSE 13. Legal use of data

13.1. The Exporter guarantees that Personal Data has been collected, processed and transferred to the Importer in accordance with the National Legislation.

CLAUSE 14. Transparency

14.1. The Designated Party shall publish, on its website, a document containing easily accessible information written in simple, clear and accurate language on the conduction of the International Data Transfer, including at least information on:

a) the form, duration and specific purpose of the international transfer;

b) the destination country of the transferred data;

c) the Designated Party's identification and contact details;

d) the shared use of data by the Parties and its purpose;

e) the responsibilities of the agents who shall conduct the processing;

f) the Data Subject's rights and the means for exercising them, including an easily accessible channel made available to respond to their requests, and the right to file a petition against the Exporter and the Importer before ANPD; and

g) Onward Transfers, including those relating to recipients and to the purpose of such transfer.

14.2. The document referred to in item 14.1. shall be made available on a specific website page or integrated, in a prominent and easily accessible format, to the Privacy Policy or equivalent document.

14.3. Upon request, the Parties shall make a copy of these Clauses available to the Data Subject free of charge, complying with trade and industrial secrecy.

14.4. All information made available to Data Subjects, under the terms of these Clauses, shall be written in Portuguese.

CLAUSE 15. Rights of the data subject

15.1. The Data subject shall have the right to obtain from the Designated Party, as regards the Personal Data subject to the International Data Transfer governed by these Clauses, at any time, and upon request, under the terms of the National Legislation:

a) confirmation of the existence of processing;

b) access to data;

c) correction of incomplete, inaccurate or outdated data;

d) anonymization, blocking or erasure of unnecessary or excessive data or data processed in noncompliance with these Clauses and the provisions of National Legislation;

e) portability of data to another service or product provider, upon express request, in accordance with ANPD regulations, complying with trade and industrial secrecy;

f) erasure of Personal Data processed under the Data Subject's consent, except for the events provided in CLAUSE 20;

g) information on public and private entities with which the Parties have shared data;

h) information on the possibility of denying consent and on the consequences of the denial;

i) withdrawal of consent through a free of charge and facilitated procedure, remaining ratified the processing activities carried out before the request for elimination;

j) review of decisions taken solely on the basis of automated processing of personal data affecting their interests, including decisions aimed at defining their personal, professional, consumer and credit profile or aspects of their personality; and

k) information on the criteria and procedures adopted for the automated decision.

15.2. Data subject may oppose to the processing based on one of the events of waiver of consent, in case of noncompliance with the provisions of these Clauses or National Legislation.

15.3 The deadline for responding to the requests provided for in this Clause and in item 14.3 is 15 (fifteen) days from the date of the data subject's request, except in the event of a different deadline established in specific ANPD regulations.

15.4. In case the Data Subject's request is directed to the Party not designated as responsible for the obligations set forth in this Clause or in item 14.3., the referred Party shall:

a) inform the Data Subject of the service channel made available by the Designated Party; or

b) forward the request to the Designated Party as early as possible, to enable the response within the period provided in item 15.3. (Amended by the RECTIFICATION of August 18, 2025)

15.5. The Parties shall immediately inform the Data Processing Agents with whom they have shared data with the correction, deletion, anonymization or blocking of the data, for them to follow the same procedure, except in cases where this communication is demonstrably impossible or involves a disproportionate effort.

15.6. The Parties shall promote mutual assistance to respond to the Data Subjects' requests.

CLAUSE 16. Security Incident Reporting

16.1. The Designated Party shall notify ANPD and the Data Subject, within 3 (three) working days of the occurrence of a security incident that may entail a relevant risk or damage to the Data Subjects, according to the provisions of National Legislation.

16.2. The Importer must keep a record of security incidents in accordance with National Legislation.

CLAUSE 17. Liability and compensation for damages

17.1. The Party which, when performing Personal Data processing activities, causes patrimonial, moral, individual or collective damage, for violating the provisions of these Clauses and of the National Legislation, shall compensate for it.

17.2. Data Subject may claim compensation for damage caused by any of the Parties as a result of a breach of these Clauses.

17.3. The defense of Data Subjects' interests and rights may be claimed in court, individually or collectively, in accordance with the provisions in relevant legislation regarding the instruments of individual and collective protection.

17.4. The Party acting as Processor shall be jointly and severally liable for damages caused by the processing activities when it fails to comply with these Clauses or when it has not followed the lawful instructions of the Controller, except for the provisions of item 17.6.

17.5. The Controllers directly involved in the processing activities which resulted in damage to the Data Subject shall be jointly and severally liable for these damages, except for the provisions of item 17.6.

17.6. Parties shall not be held liable if they have proven that:

a) they have not carried out the processing of Personal Data attributed to them;

b) although they did carry out the processing of Personal Data attributed to them, there was no violation of these Clauses or National Legislation; or

c) the damage results from the sole fault of the Data Subject or of a third-party which is not a recipient of the Onward Transfer or not subcontracted by the Parties.

17.7. Under the terms of the National Legislation, the judge may reverse the burden of proof in favor of the Data Subject whenever, in his judgement, the allegation is credible, there is a lack of sufficient evidence or when the Data Subject would be excessively burdened by the production of evidence.

17.8. Judicial proceedings for compensation for collective damages which intend to establish liability under the terms of this Clause may be collectively conducted in court, with due regard for the provisions in relevant legislation.

17.9. The Party which compensates the damage to the Data Subject shall have a right of recourse against the other responsible parties, to the extent of their participation in the damaging event.

CLAUSE 18. Safeguards for Onward Transfers

18.1. The Importer shall only carry out Onward Transfers of Personal Data subject to the International Data Transfer governed by these Clauses if expressly authorized, in accordance with the terms and conditions described in CLAUSE 3.

18.2. In any case, the Importer:

a) shall ensure that the purpose of the Onward Transfer is compatible with the specific purposes described in CLAUSE 2;

b) shall guarantee, by means of a written contractual instrument, that the safeguards provided in these Clauses shall be ensured by the third-party recipient of the Onward Transfer; and

c) for the purposes of these Clauses, and regarding the Personal Data transferred, shall be considered responsible for any eventual irregularities committed by the third-party recipient of the Onward Transfer.

18.3. The Onward Transfer shall also be carried out based on another valid modality of International Data Transfer provided in National Legislation, regardless of the authorization referred to in CLAUSE 3.

CLAUSE 19. Access Request Notification

19.1 The Importer shall notify the Exporter and the Data Subject of any Access Request related to the Personal Data subject to the International Data Transfer governed by these Clauses, except in the event that notification is prohibited by the law of the country in which the data is processed.

19.2. The Importer shall implement the appropriate legal measures, including legal actions, to protect the rights of the Data Subjects whenever there is adequate legal basis to question the legality of the Access Request and, if applicable, the prohibition of issuing the notification referred to in item 19.1.

19.3. To comply with both the ANPD's and the Exporter's requests, the Importer shall keep a record of Access Requests, including date, requester, purpose of the request, type of data requested, number of requests received, and legal measures implemented.

CLAUSE 20. Termination of processing and erasure of data

20.1. Parties shall erase the personal data subject to the International Data Transfer governed by these Clauses after the ending of their processing, within the scope and technical boundaries of the activities, being their storage authorized only for the following purposes:

a) compliance with a legal or regulatory obligation by the Controller;

b) study by a Research Body, guaranteeing, whenever possible, the anonymization of personal data;

c) transfer to a third-party, upon compliance with requirements set forth in these Clauses and in the National Legislation; and

d) exclusive use of the Controller, being the access by a third-party prohibited, and provided data have been anonymized.

20.2. For the purposes of this Clause, processing of personal data shall cease when:

a) the purpose set forth in these Clauses has been achieved;

b) Personal Data are no longer necessary or pertinent to attain the intended specific purpose set forth in these Clauses;

c) at the termination of the processing period;

d) Data Subject's request is met; and

e) at the order of ANPD, upon violation of the provisions of these Clauses or National Legislation.

CLAUSE 21. Data processing security

21.1. Parties shall implement Security Measures which guarantee sufficient protection of the Personal Data subject to the International Data Transfer governed by these Clauses, even after its termination.

21.2. Parties shall inform, in SECTION III, the Security Measures implemented, considering the nature of the processed information, the specific characteristics and the purpose of the processing, the technology current state and the probability and severity of the risks to the Data Subjects' rights, especially in the case of sensitive personal data and that of children and adolescents.

21.3. The Parties shall make the necessary efforts to implement periodic evaluation and review measures to maintain the appropriate level of data security.

CLAUSE 22. Legislation of country of destination

22.1 The Importer declares that it has not identified any laws or administrative practices of the country receiving the Personal Data that prevent it from fulfilling the obligations assumed in these Clauses.

22.2. In the event of a regulatory change which alters this situation, the Importer shall immediately notify the Exporter to assess the continuity of the contract.

CLAUSE 23. Non-compliance with the Clauses by the Importer

23.1. In the event of a breach in the safeguards and guarantees provided in these Clauses or being the Importer unable to comply with any of them, the Exporter shall be immediately notified, subject to the provisions in item 19.1.

23.2. Upon receiving the communication referred to in item 23.1 or upon verification of non-compliance with these Clauses by the Importer, the Exporter shall implement the relevant measures to ensure the protection of the Data Subjects' rights and the compliance of the International Data Transfer with the National Legislation and these Clauses, and may, as appropriate:

a) suspend the International Data Transfer;

b) request the return of the Personal Data, its transfer to a third-party, or its erasure; and

c) terminate the contract.

CLAUSE 24. Choice of forum and jurisdiction

24.1. Brazilian legislation applies to these Clauses and any controversy between the Parties arising from these Clauses shall be resolved before the competent courts in Brazil, observing, if applicable, the forum chosen by the Parties in Section IV.

24.2. Data Subjects may file lawsuits against the Exporter or the Importer, as they choose, before the competent courts in Brazil, including those in their place of residence.

24.3. By mutual agreement, Parties may use arbitration to resolve conflicts arising from these Clauses, provided that the procedure is carried out in Brazil and in accordance with the provisions of the Arbitration Law.

SECTION III – SECURITY MEASURES

• (i) Governance and supervision of internal processes: The governance, access-control, personnel-confidentiality, and subprocessor-review measures set out in Annex II to Schedule 1 above.
• (ii) Technical and administrative security measures, including measures to guarantee the security of the operations carried out, such as the collection, transmission and storage of data: The measures set out in Annex II to Schedule 1 above, including encryption in transit and at rest and logical tenant isolation. Sensitive personal data and personal data of children and adolescents are not intended to be transferred (Section 9.2 of the Terms); where any is present incidentally, the same measures apply to it.

SECTION IV – ADDITIONAL CLAUSES AND ANNEXES

• Related Contract: These Clauses form part of the Ortalio Business Terms of Service and Schedule 1 (Data Processing Addendum) between the Exporter and the Importer. Nothing in this Section, in the Terms, or in Schedule 1 excludes, modifies, or contradicts, directly or indirectly, the Clauses in Sections I, II, and III.
• Selected Options: In Clause 3, Option B applies. In Clause 4, Option A applies, and the Designated Party is the Exporter.
• Place, Date, and Signatures: Electronic clickwrap acceptance of the Ortalio Business Terms of Service constitutes valid execution of this Annex V by both Parties, on the date of that acceptance.