Data Processing Agreement

Algora S.A., as processor Version 1.0 of 1 November 2026

Current list of sub-processors

1. PURPOSE AND ROLES

1.1 This Data Processing Agreement (the "DPA") forms part of the contract between Algora S.A., 2, Rue du Fort Wallis, L-2714 Luxembourg, R.C.S. Luxembourg B288571 ("Algora" or the "Processor"), and each customer that subscribes to the Service (the "Customer" or the "Controller"), governed by the Algora Terms and Conditions (the "Terms"). It applies without signature from the Customer's acceptance of a Quote or signature of an agreement that refers to it. It sets out the conditions under which Algora processes personal data on behalf of the Customer in the course of providing the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").

1.2 The Customer acts as controller, or as processor on behalf of its own clients, for the personal data contained in Customer Data ("Customer Personal Data"). Where the Customer acts as processor, Algora acts as its sub-processor, and the Customer warrants that the instructions it gives and the appointment of Algora have been authorised by the relevant controller.

1.3 This DPA does not apply to personal data that Algora processes as controller, in particular the data of the Customer's contact persons and Authorised Users processed for account management, invoicing, security and Usage Data, which are governed by Algora's Privacy Notice.

1.4 Capitalised terms not defined in this DPA have the meaning given in the GDPR or, failing that, in the Terms. In the event of conflict between this DPA and the Terms concerning the processing of Customer Personal Data, this DPA prevails.

2. DESCRIPTION OF THE PROCESSING

2.1 The subject matter, nature, purpose and duration of the processing, the categories of personal data and the categories of data subjects are described in Annex I.

3. INSTRUCTIONS

3.1 Algora shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which Algora is subject; in such a case, Algora shall inform the Customer of that legal requirement before processing, unless that law prohibits such information.

3.2 The Terms, this DPA, the Quotes, any agreement signed by the Parties and the Customer's use and configuration of the Service constitute the Customer's complete documented instructions at the date on which this DPA starts to apply. Any additional instruction must be given in writing and be consistent with the Terms; if it entails costs or changes to the Service, the Parties shall agree on them beforehand.

3.3 Algora shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

3.4 Algora shall not process Customer Personal Data for its own purposes. In particular, Algora shall not use Customer Personal Data to train, fine-tune or improve artificial intelligence models, and shall not sell or otherwise make Customer Personal Data available to third parties, except as provided in this DPA. Aggregated statistics derived from Usage Data in accordance with Section 5.3 of the Terms shall not contain Customer Personal Data.

4. CONFIDENTIALITY

4.1 Algora shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, receive appropriate training and have access only to the data strictly necessary for their tasks.

5. SECURITY

5.1 Algora shall implement the technical and organisational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk in accordance with Article 32 of the GDPR. Algora may update these measures provided that the overall level of security is not reduced.

5.2 The Customer is responsible for the security of its own systems, for the management of its users' credentials and for the configuration options of the Service that it controls.

6. SUB-PROCESSORS

6.1 The Customer grants Algora a general written authorisation to engage the Sub-processors listed in Annex III. "Sub-processor" means any processor engaged by Algora that processes Customer Personal Data.

6.2 Algora shall inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance or, where Annex 2 of the Terms applies and the addition or replacement involves a change of the country or region of processing, at least three (3) months in advance, by email to the Customer's contact, and shall keep an up-to-date list of Sub-processors available to the Customer on request. The Customer may object on reasonable grounds relating to data protection by written notice within that period. In the event of an objection, the Parties shall discuss in good faith; if no solution is found within thirty (30) days, the Customer may terminate the affected subscription without penalty and obtain a refund of the prepaid Fees relating to the period after termination.

6.3 In an emergency, in particular where a Sub-processor must be replaced for security or continuity reasons, Algora may engage a new Sub-processor with shorter notice, provided that it informs the Customer without delay and that the Customer retains its right to object.

6.4 Algora shall impose on each Sub-processor, by contract, data protection obligations providing at least the same level of protection as this DPA, in particular sufficient guarantees regarding the implementation of appropriate technical and organisational measures. Algora remains fully liable to the Customer for the performance of the Sub-processors' obligations.

7. INTERNATIONAL TRANSFERS

7.1 Algora shall store Customer Personal Data in the European Union. Algora shall not transfer Customer Personal Data to a country outside the European Economic Area, including by remote access, unless: (a) the transfer is covered by an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified recipients; or (b) Algora has put in place the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (module 3, processor to processor) with the Sub-processor, together with a transfer impact assessment and any supplementary measures required.

7.2 The transfers authorised at the date of this DPA are described in Annex III.

7.3 If Algora or a Sub-processor receives a request from a public authority of a third country for access to Customer Personal Data, Algora shall, to the extent permitted by law, inform the Customer, challenge the request where there are reasonable grounds to consider it unlawful, and disclose only the minimum data required.

8. ASSISTANCE TO THE CUSTOMER

8.1 Taking into account the nature of the processing, Algora shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. Algora shall forward to the Customer without undue delay any request received directly from a data subject and shall not respond to it unless authorised by the Customer.

8.2 Algora shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Algora.

8.3 Assistance that goes beyond the provision of information available to Algora and the functionalities of the Service may be invoiced at Algora's rates in force, communicated in advance, except where the assistance is required as a result of a breach by Algora.

9. PERSONAL DATA BREACHES

9.1 Algora shall notify the Customer without undue delay, and in any event within twenty-four (24) hours, after becoming aware, including through notification by a Sub-processor, of a personal data breach affecting Customer Personal Data.

9.2 The notification shall contain, to the extent available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the name and contact details of Algora's contact point; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Where all the information is not available at the same time, it may be provided in phases without undue further delay.

9.3 Algora shall not notify the supervisory authority or the data subjects on behalf of the Customer unless instructed to do so by the Customer, except where Algora is itself required to do so by law.

10. RETURN AND DELETION

10.1 Upon expiry or termination of the Contract, Algora shall make Customer Personal Data available for retrieval and shall then delete it in accordance with Section 9 of the Terms. Algora shall delete existing copies, unless Union or Member State law requires their storage.

10.2 Copies contained in backups shall be deleted in accordance with the normal backup rotation cycle, which does not exceed five (5) years, and shall remain protected by this DPA until deleted. Upon request, Algora shall confirm the deletion in writing.

11. AUDITS

11.1 Algora shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, including its security policies, the list of Sub-processors and, where available, its certifications and audit reports.

11.2 Where the information provided under Section 11.1 is not sufficient, the Customer may carry out, or have carried out by an independent auditor bound by confidentiality who is not a competitor of Algora, an audit of the processing of Customer Personal Data, no more than once per calendar year, except in the event of a personal data breach or a request from a supervisory authority. The audit shall be announced at least thirty (30) days in advance, carried out during business hours, without disrupting the Service and without access to the data of other customers. The costs of the audit are borne by the Customer, unless the audit reveals a material breach by Algora.

11.3 Where Part C of Annex 2 to the Terms applies, the audit and access rights provided in that Part apply in addition to this Section.

12. LIABILITY AND DURATION

12.1 The liability of each Party under this DPA is subject to the limitations and exclusions of the Terms, including the liability limit provided in Section 13.3 of the Terms, without prejudice to the rights of data subjects under Article 82 of the GDPR.

12.2 This DPA applies for as long as Algora processes Customer Personal Data on behalf of the Customer.

12.3 This DPA is governed by Luxembourg law and is subject to the jurisdiction clause of the Terms.

ANNEX I: DESCRIPTION OF THE PROCESSING

ANNEX II: TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

ANNEX III: AUTHORISED SUB-PROCESSORS AND ICT SUBCONTRACTORS

This list is current at the date of this version of the DPA; later changes are notified in accordance with Section 6.2. The providers below receive only what is stated. Providers that receive no Customer Personal Data are not Sub-processors within the meaning of Section 6 and are listed for transparency and for the Customer's register of information under DORA. Queries sent to search, news and market data providers are generated as entity and ticker terms; the Customer's raw prompts are never forwarded, and every outbound request is logged.