Data Processing Addendum

Preamble

This DPA applies to the extent AccessFuel Processes Personal Data on Customer's behalf in connection with the Services and is subject to Data Protection Laws.

This DPA becomes binding on both parties upon Customer entering into the Agreement. No separate signature is required. By entering into the Agreement, Customer accepts this DPA on its own behalf and, to the extent required under Data Protection Laws, on behalf of its Authorized Affiliates.

Where Customer's procurement or compliance process requires a separately executed instrument, Customer may execute the signature block at the end of this DPA and submit it to privacy@accessfuel.com. A separately executed copy does not alter the terms of this DPA and does not take effect until countersigned by AccessFuel.

In the event of a conflict, this DPA prevails over the remainder of the Agreement with respect to the Processing of Personal Data. The Standard Contractual Clauses prevail over this DPA to the extent of any conflict.

1. Definitions

1.1 "Agreement" has the meaning given in the Preamble.

1.2 "Authorized Affiliate" means any entity that controls, is controlled by, or is under common control with Customer and that is permitted to use the Services under the Agreement.

1.3 "Customer Personal Data" means Personal Data contained in Customer Data that AccessFuel Processes on Customer's behalf under the Agreement.

1.4 "Data Protection Laws" means all laws applicable to the Processing of Customer Personal Data under the Agreement, including, as applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as incorporated into United Kingdom law by the European Union (Withdrawal) Act 2018 ("UK GDPR") and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection ("FADP"); and the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA").

1.5 "Data Subject", "Controller", "Processor", "Supervisory Authority", "Personal Data", "Personal Data Breach" and "Processing" (and "Process") have the meanings given in the GDPR. "Business", "Service Provider", "Sell", "Share" and "Consumer" have the meanings given in the CCPA.

1.6 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

1.7 "Subprocessor" means any Processor engaged by AccessFuel (or by an AccessFuel affiliate) to Process Customer Personal Data.

1.8 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0).

Capitalized terms not defined in this DPA have the meaning given in the Agreement.

2. Roles of the Parties

2.1 Roles. For Customer Personal Data, Customer is the Controller (and, under the CCPA, the Business) and AccessFuel is the Processor (and, under the CCPA, the Service Provider). Where Customer is itself a Processor acting on behalf of a third-party Controller, AccessFuel is a Subprocessor and Customer warrants that it has the third-party Controller's authority to enter into this DPA.

2.2 Customer responsibilities. Customer is responsible for: (a) the lawfulness of its instructions and of the Customer Personal Data it submits to the Services, including having a valid legal basis and providing required notices to Data Subjects; (b) the accuracy and quality of Customer Data; (c) configuring the Services, including workspace membership and access roles, appropriately for its use case; and (d) securing its own credentials and the credentials of the third-party data sources it connects.

2.3 AccessFuel responsibilities. AccessFuel Processes Customer Personal Data only as set out in this DPA and the Agreement.

2.4 AccessFuel as Controller. AccessFuel is an independent Controller with respect to account registration data, billing data, authentication metadata, security logs, and product telemetry that AccessFuel Processes to operate, secure, bill for and improve the Services. That Processing is governed by the AccessFuel Privacy Policy and not by this DPA.

3. Details of Processing

3.1 Subject matter. AccessFuel's provision of the Services to Customer under the Agreement.

3.2 Duration. The term of the Agreement, plus the period until Customer Personal Data is deleted or returned in accordance with Section 7.

3.3 Nature and purpose. AccessFuel ingests Customer Data from the commerce, ticketing, CRM and marketing platforms connected by Customer (for example Shopify, HubSpot, Klaviyo, ticketing systems, web and advertising analytics platforms) and from files uploaded by Customer (for example CSV), stores it in AccessFuel's operational and analytics infrastructure, and Processes it to provide the Services, which include: data ingestion and pipeline transformation; storage and hosting; dashboards and reporting; audience segmentation and customer persona generation; document indexing and retrieval; and AI-assisted analysis through the AIRA assistant, which submits relevant Customer Personal Data to third-party AI model providers engaged as Subprocessors. AccessFuel also Processes Customer Personal Data to provide support and to maintain the security, availability and integrity of the Services.

3.4 Categories of Personal Data. Customer determines what Customer Data it submits. Customer Personal Data typically includes:

Identifiers: customer, order, ticket, account, member, subscriber and profile identifiers assigned by Customer or by a connected source system; pseudonymous IDs.

Contact details: name, email address, telephone number, postal and billing/shipping address.

Transaction, order and ticketing data: order, booking and line-item history, transaction value, currency, discounts, refunds, product, SKU, ticket, seat, membership and event data, purchase and attendance dates and frequency, lifetime value and derived metrics.

Marketing engagement data: email and campaign sends, opens, clicks, unsubscribes, list and flow membership, subscription status, campaign and ad attribution data.

Device and usage data: IP address, user-agent, device and browser attributes, session and web or app analytics event data, referral and traffic source, approximate location derived from IP.

Derived data: segment membership, RFM and similar scores, persona attributes and other analytical outputs generated by the Services.

Free-text data: any Personal Data Customer includes in CSV uploads, uploaded documents, or prompts submitted to AIRA.

3.5 Categories of Data Subjects. Customer's end customers, audience and prospects, including purchasers, ticket buyers, subscribers, members, fans and event attendees, donors, marketing contacts and email or SMS recipients, website and mobile app visitors, and holders of accounts with Customer; and Customer's own personnel who are authorized users of the Services.

3.6 Special category data. The Services are not designed or intended to Process special categories of Personal Data (Article 9 GDPR), data relating to criminal convictions and offences (Article 10 GDPR), government-issued identifiers, financial account or payment card numbers, health data, or the Personal Data of children. Customer must not submit such data to the Services. If Customer nonetheless submits such data, Customer does so at its own risk and remains solely responsible for the consequences, and AccessFuel's obligations under this DPA are unchanged.

3.7 Frequency. Continuous, for the duration described in Section 3.2.

4. AccessFuel Obligations

4.1 Documented instructions. AccessFuel shall Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country. The Agreement, this DPA, and Customer's configuration and use of the Services (including the data sources Customer connects, the segments and reports Customer runs, and the prompts Customer submits to AIRA) constitute Customer's complete and final documented instructions. Additional instructions require written agreement and may be subject to additional fees where they exceed the scope of the Services.

4.2 Unlawful instructions. AccessFuel shall inform Customer if, in its opinion, an instruction infringes Data Protection Laws, unless prohibited from doing so by law. AccessFuel may suspend the affected Processing until the instruction is withdrawn, amended or confirmed.

4.3 Legally required Processing. If AccessFuel is required by applicable law to Process Customer Personal Data other than on Customer's instructions, AccessFuel shall inform Customer of that legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest. AccessFuel shall notify Customer of any legally binding request for disclosure of Customer Personal Data by a public authority unless prohibited, shall challenge requests it considers unlawful, and shall disclose only the minimum amount of data legally required.

4.4 Confidentiality. AccessFuel shall ensure that personnel authorized to Process Customer Personal Data are bound by an appropriate statutory or contractual obligation of confidentiality that survives termination of their engagement.

4.5 Personnel. AccessFuel shall limit access to Customer Personal Data to personnel who require access to perform the Agreement, shall apply the principle of least privilege, and shall provide those personnel with appropriate training on their data protection and security obligations.

4.6 Security. AccessFuel shall implement and maintain the technical and organizational measures described in Annex II to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. AccessFuel may update those measures from time to time provided the overall level of security is not materially reduced.

4.7 Assistance with data-subject requests. Taking into account the nature of the Processing, AccessFuel shall assist Customer by appropriate technical and organizational measures, insofar as reasonably possible, in fulfilling Customer's obligation to respond to requests to exercise Data Subject rights under Data Protection Laws. The Services provide functionality allowing Customer to access, correct, export and delete Customer Personal Data. If AccessFuel receives a request directly from a Data Subject relating to Customer Personal Data, AccessFuel shall not respond to it other than to acknowledge receipt and direct the Data Subject to Customer, and shall promptly forward the request to Customer where it can identify the relevant Customer.

4.8 Assistance with DPIAs and consultations. AccessFuel shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36 GDPR, taking into account the nature of the Processing and the information available to AccessFuel. Assistance beyond the provision of AccessFuel's standard documentation may be subject to reasonable fees.

5. Subprocessors

5.1 General authorization. Customer grants AccessFuel general written authorization to engage Subprocessors to Process Customer Personal Data in connection with the Services, subject to this Section 5. AccessFuel's affiliates may be engaged as Subprocessors on the same terms.

5.2 Current list. The current list of Subprocessors, including their purpose and location, is available to Customer on request from privacy@accessfuel.com and is incorporated into this DPA as Annex III.

5.3 Notice and objection. Customer may subscribe to notifications of changes to the Subprocessor list by written request to privacy@accessfuel.com. AccessFuel shall give at least thirty (30) days' notice before a new Subprocessor begins Processing Customer Personal Data. Customer may object on reasonable data-protection grounds by written notice to privacy@accessfuel.com within that 30-day period. The parties shall discuss the objection in good faith; if AccessFuel is unable to make available a commercially reasonable alternative within a reasonable period, Customer may, as its sole and exclusive remedy, terminate the affected Services or Subscription by written notice, with a pro-rata refund of prepaid fees for the terminated portion of the then-current term. Absent objection within the notice period, the new Subprocessor is deemed authorized.

5.4 Flow-down and liability. AccessFuel shall enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective than those in this DPA, to the extent applicable to the nature of the Subprocessor's services. AccessFuel remains fully liable to Customer for the performance of each Subprocessor's obligations.

5.5 AI model providers. Certain features of the Services, including AIRA, transmit Customer Personal Data to third-party providers of large language models and other AI models. Those providers are Subprocessors and are identified as such in the Subprocessor list. With respect to those providers, AccessFuel shall:

(a) use enterprise or commercial API terms, and not consumer-facing offerings;

(b) where the provider offers them, enable zero-data-retention or equivalent limited-retention terms, and otherwise contract for the shortest retention period the provider makes available;

(c) not permit any AI model provider to use Customer Personal Data to train, fine-tune or otherwise improve its models, and require contractual terms to that effect; and

(d) not itself use Customer Personal Data to train models for the benefit of any other customer.

Outputs generated by AI features are probabilistic and may be inaccurate. Customer remains responsible for reviewing outputs before relying on them, including where those outputs inform decisions about Data Subjects. The Services are not intended to be used for solely automated decision-making producing legal or similarly significant effects on Data Subjects.

6. Personal Data Breach

6.1 Notification. AccessFuel shall notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event no later than seventy-two (72) hours after becoming aware of it.

6.2 Content. The notification shall include, to the extent known at the time and supplemented as further information becomes available: the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information.

6.3 Assistance. AccessFuel shall provide reasonable assistance to Customer in meeting Customer's own notification obligations to Supervisory Authorities and Data Subjects.

6.4 No admission. AccessFuel's notification of or response to a Personal Data Breach is not an acknowledgement of fault or liability.

6.5 Customer notice contact. AccessFuel will send notices to the administrative and security contacts designated in Customer's account. Customer is responsible for keeping those contacts current.

7. Deletion and Return

7.1 During the term. Customer may export or delete Customer Personal Data at any time using the functionality of the Services.

7.2 On termination. Upon termination or expiry of the Agreement, AccessFuel shall, at Customer's election, delete or return Customer Personal Data and delete existing copies. Customer must make its election, and complete any export, within thirty (30) days of termination. Absent a timely election, AccessFuel shall delete Customer Personal Data.

7.3 Timing and backups. Deletion will be completed within thirty (30) days of the end of the period in Section 7.2, except that Customer Personal Data residing in encrypted routine backups will be deleted on the ordinary backup expiry cycle. Until deleted, such data remains protected by the measures in Annex II and is not actively Processed.

7.4 Retention required by law. AccessFuel may retain Customer Personal Data to the extent required by applicable law, and only for the period and purpose required, subject to continued confidentiality and the measures in Annex II.

8. International Transfers

8.1 General. AccessFuel may transfer and Process Customer Personal Data in the United States and other countries where AccessFuel or its Subprocessors operate, subject to this Section 8.

8.2 EU Standard Contractual Clauses. Where Customer Personal Data protected by the GDPR is transferred from the European Economic Area to a country not subject to an adequacy decision, the SCCs are incorporated into this DPA by reference and are deemed executed by the parties upon Customer entering into the Agreement, as follows:

(a) Module Two (Controller to Processor) applies where Customer is a Controller; Module Three (Processor to Processor) applies where Customer is a Processor acting on behalf of a third-party Controller.

(b) Customer (and, where applicable, the Authorized Affiliate) is the data exporter; AccessFuel is the data importer.

(c) Clause 7 (docking clause) applies.

(d) Clause 9: Option 2 (general written authorization) applies, with a notice period of thirty (30) days as set out in Section 5.3.

(e) Clause 11: the optional independent dispute resolution paragraph does not apply.

(f) Clause 13 and Annex I.C: the competent Supervisory Authority is determined in accordance with Clause 13.

(g) Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland.

(h) Clause 18(b): disputes shall be resolved before the courts of Ireland.

(i) Annex I to the SCCs is populated by Annex I to this DPA; Annex II to the SCCs is populated by Annex II to this DPA; the list of Subprocessors required for Clause 9 is Annex III to this DPA.

8.3 UK Addendum. Where Customer Personal Data protected by the UK GDPR is transferred, the UK Addendum is incorporated by reference and deemed executed upon Customer entering into the Agreement. For the purposes of the UK Addendum: Table 1 is populated by Annex I of this DPA; Tables 2 and 3 are populated by Section 8.2 and Annexes I–III of this DPA; and in Table 4, neither party may end the UK Addendum as set out in Section 19 of the UK Addendum. References in the SCCs to the GDPR are read as references to the UK GDPR, and references to EU Member State law are read as references to UK law.

8.4 Swiss FADP. Where Customer Personal Data protected by the FADP is transferred, the SCCs apply with the following adaptations: the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (and, for transfers subject to both the GDPR and the FADP, the authority determined under Clause 13 for the GDPR portion); references to the GDPR are read as references to the FADP; the term "Member State" does not limit Data Subjects in Switzerland from bringing proceedings in their place of habitual residence; and the SCCs also protect the data of legal entities until such protection ceases under the FADP.

8.5 Alternative mechanisms. If AccessFuel adopts an alternative lawful transfer mechanism (including a certification under a recognized data privacy framework), that mechanism applies instead of, or in addition to, the mechanisms in this Section 8 to the extent it lawfully covers the transfer, and the SCCs continue to apply to transfers not covered by it.

9. CCPA and US State Privacy Laws

9.1 Roles. With respect to Customer Personal Data subject to the CCPA, Customer is the Business and AccessFuel is a Service Provider. AccessFuel Processes such data solely to perform the Services under the Agreement (the "Business Purpose").

9.2 Restrictions. AccessFuel shall not:

(a) Sell or Share Customer Personal Data;

(b) retain, use or disclose Customer Personal Data for any purpose other than the Business Purpose, including for any commercial purpose other than performing the Services, or outside the direct business relationship with Customer, except as permitted by the CCPA;

(c) combine Customer Personal Data with Personal Data received from or on behalf of another person, or collected from its own interactions with Consumers, except as permitted by the CCPA for a Service Provider; or

(d) use Customer Personal Data to build or improve profiles of Consumers for use outside the Services provided to Customer.

9.3 Certification. AccessFuel understands the restrictions in Section 9.2 and certifies that it will comply with them.

9.4 Assistance and oversight. AccessFuel shall provide the same level of privacy protection as required of a Business under the CCPA in respect of the Customer Personal Data it Processes, shall notify Customer if it determines it can no longer meet its obligations under the CCPA, and shall assist Customer in responding to verifiable Consumer requests. Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including by exercising the rights in Section 10.

9.5 Other US state laws. Where other US state privacy laws apply, AccessFuel acts as a "processor," "service provider" or equivalent, Processes Customer Personal Data only on Customer's instructions for the purposes set out in Section 3, and shall comply with the corresponding obligations of such laws, including duties of confidentiality, subprocessor engagement, deletion or return, and cooperation with assessments.

10. Audits and Documentation

10.1 Documentation. AccessFuel shall make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including a current description of the technical and organizational measures in Annex II and, where AccessFuel produces them, security summaries and penetration-test summaries. Current security documentation is available at AccessFuel's trust center: https://trust.inc/org_69aafd0a3fdca3ccbcd8e957.

10.2 Questionnaires. AccessFuel shall respond within a reasonable period to Customer's reasonable written security and privacy questionnaires relating to AccessFuel's Processing of Customer Personal Data, no more than once in any twelve (12) month period unless a Personal Data Breach has occurred or a Supervisory Authority requires otherwise.

10.3 Audits. Where the information made available under Sections 10.1 and 10.2 is not sufficient to demonstrate compliance, and to the extent required by Data Protection Laws or the SCCs, AccessFuel shall allow for and contribute to an audit conducted by Customer or an independent auditor mandated by Customer and not reasonably objected to by AccessFuel. Any such audit shall: be requested at least thirty (30) days in advance; take place during business hours; occur no more than once in any twelve (12) month period (except where required by a Supervisory Authority or following a Personal Data Breach); be subject to confidentiality obligations; not unreasonably disrupt AccessFuel's business; and not extend to the data, systems or information of other AccessFuel customers or to information whose disclosure would compromise AccessFuel's security. Customer bears its own and AccessFuel's reasonable costs of any on-site audit.

10.4 Subprocessor audits. AccessFuel shall use commercially reasonable efforts to obtain, and to make available to Customer on request, the audit reports or equivalent documentation of its Subprocessors, subject to confidentiality.

11. Liability

11.1 Each party's liability arising out of or related to this DPA, including the SCCs, is subject to the limitations and exclusions of liability set out in the Agreement, to the fullest extent permitted by applicable law.

11.2 Nothing in this DPA limits any liability that cannot be limited under Data Protection Laws, including the rights of Data Subjects under the SCCs.

12. Term, Changes and Miscellaneous

12.1 Term. This DPA takes effect on the effective date of the Agreement and continues until AccessFuel ceases to Process Customer Personal Data. Provisions that by their nature should survive termination do so.

12.2 Changes. AccessFuel may update this DPA where required to reflect changes in Data Protection Laws, the Services, or AccessFuel's Subprocessors, provided that no update materially reduces the protections afforded to Customer Personal Data. AccessFuel shall publish the updated DPA with a new version number and effective date and, where the change is material, give Customer at least thirty (30) days' notice before it takes effect.

12.3 Authorized Affiliates. An Authorized Affiliate that is a Controller of Customer Personal Data is a party to this DPA as a data exporter for the purposes of Section 8. Customer remains responsible for coordinating all communications with AccessFuel under this DPA on behalf of its Authorized Affiliates, and only Customer may exercise the rights in Sections 5.3 and 10.

12.4 Notices. Notices under this DPA shall be given to privacy@accessfuel.com (for AccessFuel) and to the administrative contact designated in Customer's account (for Customer).

12.5 Severability. If any provision of this DPA is held invalid or unenforceable, the remainder remains in effect.

12.6 Governing law. Except as set out in Sections 8.2(g) and 8.3 in respect of the SCCs and the UK Addendum, this DPA is governed by the governing law and subject to the jurisdiction and venue set out in the Agreement.

Annex I — Description of the Processing: A. List of Parties

Annex I — Description of the Processing: B. Description of Transfer

Annex I — Description of the Processing: C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs. For UK transfers, the UK Information Commissioner's Office. For Swiss transfers, the Swiss Federal Data Protection and Information Commissioner.

Annex II — Technical and Organizational Measures

AccessFuel implements and maintains the following measures. AccessFuel does not currently claim any third-party security certification or attestation, and nothing in this Annex should be read as such a claim.

Annex II — Technical and Organizational Measures: Encryption

• Customer Personal Data is encrypted in transit over public networks using TLS 1.2 or higher.
• Customer Personal Data is encrypted at rest in AccessFuel's databases, object storage and backups using industry-standard algorithms (AES-256 or equivalent), as provided by the underlying infrastructure Subprocessors.
• Credentials and access tokens for Customer-connected data sources are encrypted at the application layer before storage, with keys held separately from the data store.

Annex II — Technical and Organizational Measures: Access control and tenant isolation

• The Services are multi-tenant with logical isolation. Customer Data is scoped to Customer's workspace, and every data access path enforces workspace scoping.
• Role-based access control within each workspace (owner, admin, member, viewer) allows Customer to control what its own users can see and do.
• Authentication uses per-session credentials with server-side session management; support for multi-factor authentication where offered by the identity mechanism in use.

Annex II — Technical and Organizational Measures: Personnel and administrative access

• Access to production systems and Customer Personal Data is restricted to personnel with an operational need, on a least-privilege basis, and is reviewed periodically.
• Administrative access requires individual named accounts and multi-factor authentication.
• Personnel are bound by written confidentiality obligations and receive security and data protection training.
• Access is revoked promptly on role change or termination.

Annex II — Technical and Organizational Measures: Secrets management

• Application secrets and infrastructure credentials are stored in managed secret stores, not in source code, and are rotated on a defined basis and on suspected compromise.

Annex II — Technical and Organizational Measures: Logging and monitoring

• Application, infrastructure and authentication events are logged.
• Error and availability monitoring, alerting and on-call escalation are in place.
• Logs are retained for a defined period and access to them is restricted.

Annex II — Technical and Organizational Measures: Secure development and change management

• Source code is version-controlled; changes are peer-reviewed before deployment to production.
• Automated static analysis, type checking and dependency vulnerability scanning run in the build pipeline.
• Environments are separated (development, preview, production) and production Customer Personal Data is not used in development environments.

Annex II — Technical and Organizational Measures: Availability, resilience and backups

• Managed database services with automated backups and point-in-time recovery, where offered by the underlying provider.
• Backups are encrypted and retained for a defined period.
• Infrastructure is deployed on managed, redundant cloud platforms.

Annex II — Technical and Organizational Measures: Network and application security

• Bot protection, rate limiting and DDoS mitigation at the network edge.
• Input validation and output sanitization in the application layer.
• Restricted network access to data stores.

Annex II — Technical and Organizational Measures: Vendor and Subprocessor management

• Subprocessors are reviewed for security and data protection posture before engagement and are bound by written data protection terms.
• The Subprocessor list is maintained by AccessFuel and made available to Customer on request.

Annex II — Technical and Organizational Measures: Incident response

• A documented incident response process covering detection, triage, containment, remediation, customer notification and post-incident review.

Annex II — Technical and Organizational Measures: Deletion

• Customer-initiated deletion via the Services, and deletion or return on termination in accordance with Section 7 of the DPA.

Annex II — Technical and Organizational Measures: Measures for transfers to Subprocessors

• Written data protection terms with each Subprocessor, transfer mechanisms as required (including the SCCs where applicable), encryption in transit, and scoping of data disclosed to the minimum necessary for the Subprocessor's function.

Annex III — List of Subprocessors

Customer has granted general written authorization for the engagement of Subprocessors under Section 5 of this DPA.

The current list of Subprocessors, including each Subprocessor's name, the Processing it performs, and the country or region in which it Processes Customer Personal Data, is maintained by AccessFuel and is available to Customer on request from:

privacy@accessfuel.com

That list is incorporated into this DPA by reference and forms Annex III for the purposes of Clause 9 of the SCCs. Customer may subscribe to notifications of changes to that list by written request to the same address. Changes are subject to the notice and objection rights in Section 5.3.

Signature Block

For reference purposes only — this DPA is executed by acceptance of the Agreement. No signature is required for this DPA to be binding. This block is provided solely for customers whose internal procurement or compliance processes require a countersigned copy; a signed copy does not modify the terms above and takes effect only when countersigned by AccessFuel.

By signing below, the parties confirm their agreement to this DPA and, where applicable, to the Standard Contractual Clauses and UK Addendum incorporated by reference in Section 8.

Document version

AccessFuel Data Processing Addendum, Version 1.0. Effective August 26, 2026.