AGGLO DATA PROCESSING AGREEMENT

United States and Puerto Rico

Effective Date: October 8, 2026
Published at: agglo.cloud/us/dpa
Version: 1.0

This Data Processing Agreement forms Exhibit A to the Agglo Terms of Service (United States and Puerto Rico). This English-language version is the governing version.

This Data Processing Agreement (this "DPA") is entered into between Naydiris LLC, a Puerto Rico limited liability company ("Naydiris"), and the Customer identified in the Agreement ("Customer"), and is effective upon Customer's acceptance of the Agglo Terms of Service (the "Terms").

1. DEFINITIONS

Capitalized terms used but not defined in this DPA have the meanings given in the Terms. In addition:

1.1 "Applicable Data Protection Law" means all laws of the United States, its states and the Commonwealth of Puerto Rico that apply to the Processing of Customer Personal Information under the Agreement, including, to the extent applicable, the California Consumer Privacy Act of 2018, as amended, and its implementing regulations, the comprehensive consumer privacy statutes of other states, the Citizen Information on Data Banks Security Act, Act No. 111 of September 7, 2005, as amended, and state data-breach notification and data-security statutes.

1.2 "Customer Personal Information" means Personal Information contained in Customer Data that Naydiris Processes on behalf of Customer in providing the Services.

1.3 "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Information transmitted, stored or otherwise Processed by Naydiris or its Subprocessors.

1.4 "Subprocessor" means any third party engaged by Naydiris to Process Customer Personal Information.

2. ROLES AND SCOPE

2.1 Roles. Customer is the business, controller or equivalent party with respect to Customer Personal Information, and Naydiris is Customer's service provider, processor or equivalent party, in each case as such terms are defined in Applicable Data Protection Law.

2.2 Details of Processing.

(a) Subject matter and duration: the provision of the Services for the Subscription Term and the Export Period, and the deletion period set forth in Section 10.
(b) Nature and specified business purposes: hosting, storage, retrieval, display, transmission (including the sending of transactional email on Customer's behalf), export and deletion of Customer Personal Information, solely for the purposes of providing, maintaining, securing and supporting the Modules and Services contracted by Customer, as described in the Terms and the Documentation.
(c) Categories of individuals: Customer's End Customers (clients, prospective clients, purchasers, client-portal account holders and website and online-store visitors) and Customer's Authorized Users and staff.
(d) Categories of Customer Personal Information: identifiers and contact information; contents of messages and forms submitted to Customer; client records, notes and custom fields defined by Customer; commercial information, including quotations, invoices, orders and payment records (excluding payment card numbers); project and task records; files; feedback responses and publication elections; client-portal account information; online-store order information; records of privacy-notice acceptance; and staff records, cost and billable rates and time entries.
(e) Sensitive information: Customer shall not submit categories of sensitive information prohibited by Section 6.1(e) of the Terms.

3. CUSTOMER INSTRUCTIONS

3.1 Processing on Instructions. Naydiris shall Process Customer Personal Information only on Customer's documented instructions, which consist of the Agreement, Customer's configuration and use of the Services, and any additional written instructions agreed by the Parties, unless Processing is required by applicable law, in which case Naydiris shall inform Customer of that legal requirement before Processing, unless the law prohibits such notice.

3.2 Unlawful Instructions. Naydiris shall promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

3.3 Customer Obligations. Customer shall ensure that its instructions comply with Applicable Data Protection Law and that it has provided all notices and obtained all consents necessary for Naydiris to Process Customer Personal Information under the Agreement.

4. RESTRICTIONS ON NAYDIRIS

Naydiris shall not:

(a) sell or share Customer Personal Information, as the terms "sell" and "share" are defined in Applicable Data Protection Law;
(b) retain, use or disclose Customer Personal Information for any purpose other than the specified business purposes described in Section 2.2(b), including for any commercial purpose other than providing the Services;
(c) retain, use or disclose Customer Personal Information outside the direct business relationship between Naydiris and Customer;
(d) combine Customer Personal Information with Personal Information that Naydiris receives from or on behalf of another person, or collects from its own interactions with individuals, except as permitted by Applicable Data Protection Law; or
(e) use Customer Personal Information for advertising, profiling or the training of any model.

5. CONFIDENTIALITY AND PERSONNEL

5.1 Naydiris shall ensure that each person authorized to Process Customer Personal Information is subject to an obligation of confidentiality that survives the termination of that person's engagement.

5.2 Naydiris personnel shall access Customer Personal Information only as set forth in Section 4.4 of the Terms.

6. SECURITY

6.1 Measures. Naydiris shall implement and maintain administrative, technical and physical safeguards appropriate to the nature of Customer Personal Information and the risks of its Processing, which shall include at a minimum:

(a) encryption of Customer Personal Information in transit over public networks by means of Transport Layer Security;
(b) encryption at rest of the Platform's database and file storage;
(c) logical separation of Customer's data from that of other customers, enforced at the database level by row-level security and by per-customer scoping of queries and file storage;
(d) restriction of access to production systems and Customer Personal Information to authorized personnel with a need to know;
(e) encrypted storage of secrets and credentials, including Customer's payment-processor credentials;
(f) verification, for each application interface route, of the caller's identity, role and entitlement;
(g) automated database backups and deletion protection; and
(h) review of each release prior to deployment.

6.2 Updates. Naydiris may update its security measures from time to time, provided that no update shall materially diminish the overall level of protection afforded to Customer Personal Information.

7. SUBPROCESSORS

7.1 Authorization. Customer generally authorizes Naydiris to engage Subprocessors. The Subprocessors engaged as of the Effective Date are listed in Annex 1.

7.2 Conditions. Naydiris shall (a) engage each Subprocessor under a written agreement imposing data-protection obligations no less protective of Customer Personal Information than those of this DPA, to the extent applicable to the services provided; and (b) remain responsible to Customer for the performance of each Subprocessor's obligations.

7.3 Changes. Naydiris shall notify Customer by email of any intended addition or replacement of a Subprocessor at least thirty (30) days before the new Subprocessor Processes Customer Personal Information. Customer may object on reasonable grounds relating to data protection within that period. If the Parties cannot resolve the objection in good faith, Customer may terminate the affected Order Form, and Naydiris shall refund any prepaid Fees attributable to the period following termination.

7.4 Customer's Third-Party Services. Third-Party Services that Customer elects to connect, including Customer's own Stripe account, are engaged by and act on behalf of Customer and are not Subprocessors of Naydiris.

8. ASSISTANCE

8.1 Individual Requests. Taking into account the nature of the Processing, Naydiris shall assist Customer, by appropriate technical and organizational measures, in fulfilling Customer's obligations to respond to requests from individuals to exercise their rights under Applicable Data Protection Law, including by making available the export and deletion functions of the Services. If Naydiris receives such a request directly, Naydiris shall forward it to Customer within five (5) business days and shall not respond to it except to direct the individual to Customer, unless otherwise required by law.

8.2 Other Assistance. Naydiris shall provide Customer with information reasonably necessary for Customer to conduct and document any assessment required of Customer under Applicable Data Protection Law with respect to the Services.

8.3 Notice of Inability to Comply. Naydiris shall notify Customer if Naydiris determines that it can no longer meet its obligations under Applicable Data Protection Law, and Customer may thereupon take reasonable and appropriate steps to stop and remediate any unauthorized Processing.

9. SECURITY INCIDENTS

9.1 Notification. Naydiris shall notify Customer of a Security Incident without undue delay, and in any event within seventy-two (72) hours after becoming aware of it.

9.2 Content. The notification shall describe, to the extent then known, the nature of the Security Incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it. Where information is not available at the time of notification, Naydiris shall provide it in phases as it becomes available.

9.3 Cooperation. Naydiris shall take reasonable steps to contain and remediate the Security Incident and shall provide Customer with such cooperation as Customer reasonably requests to enable Customer to fulfil any obligation to notify affected individuals, the Puerto Rico Department of Consumer Affairs, state attorneys general or other authorities under Applicable Data Protection Law. Unless required by law, Naydiris shall not notify individuals or authorities of a Security Incident affecting Customer Personal Information without Customer's prior approval.

9.4 No Acknowledgment of Fault. Naydiris's notification of or response to a Security Incident shall not constitute an acknowledgment of fault or liability.

10. RETURN AND DELETION

10.1 Customer may export Customer Personal Information at any time during the Subscription Term and during the Export Period, at no charge.

10.2 Within ninety (90) days following the expiration of the Export Period, Naydiris shall permanently delete Customer Personal Information from its production systems, except to the extent retention is required by applicable law, in which case Naydiris shall continue to protect such information in accordance with this DPA and shall not actively Process it except as required by that law. Residual copies in backups shall expire within seven (7) days thereafter.

10.3 Upon Customer's written request, Naydiris shall certify such deletion in writing.

11. DEMONSTRATION OF COMPLIANCE

11.1 Upon Customer's written request, not more than once in any twelve (12) month period except following a Security Incident or at the request of a regulator, Naydiris shall provide written responses to reasonable questionnaires regarding its Processing of Customer Personal Information and its security measures.

11.2 Customer may take reasonable and appropriate steps, including such questionnaires, to ensure that Naydiris Processes Customer Personal Information in a manner consistent with Customer's obligations under Applicable Data Protection Law. Any on-site audit shall require Naydiris's prior written agreement as to scope, timing and confidentiality, and shall be at Customer's expense.

12. GOVERNMENT REQUESTS

If Naydiris receives a subpoena, court order or other request from a governmental authority for Customer Personal Information, Naydiris shall, unless prohibited by law, promptly notify Customer, give Customer a reasonable opportunity to seek a protective order, and disclose only the information it is legally required to disclose.

13. LIABILITY; ORDER OF PRECEDENCE; TERM

13.1 Each Party's liability under this DPA is subject to Article 19 of the Terms.

13.2 In the event of conflict between this DPA and the Terms regarding the Processing of Customer Personal Information, this DPA shall control.

13.3 This DPA remains in effect for as long as Naydiris Processes Customer Personal Information.

ANNEX 1 — SUBPROCESSORS

ANNEX 2 — CUSTOMER CONTACT FOR PRIVACY NOTICES

Customer's designated notification email address associated with its account, unless Customer designates another address in writing.