Fuzu Data Processing Addendum

This Data Processing Addendum ("DPA") applies to the processing of Customer Personal Data by Fuzu Ltd or any of its affiliates contracting with the Customer ("Fuzu", "Processor") on behalf of the Customer ("Controller") in the course of providing the Service under the Fuzu Service Terms and any related commercial agreement (together, the "Agreement").

In this DPA, capitalised terms not defined here have the meanings given in the Service Terms or, where applicable, in Applicable Data Protection Law:

• "Applicable Data Protection Law" means all laws relating to the protection of personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Kenya Data Protection Act, 2019, the Uganda Data Protection and Privacy Act, 2019, the Nigeria Data Protection Act, 2023, and the regulations and guidance issued under those laws.
• "Customer Personal Data" means personal data processed by Fuzu on behalf of the Customer in the course of providing the Service, as further described in Annex I.
• "Data Subject Request" means a request from a data subject to exercise rights granted to that data subject by Applicable Data Protection Law.
• "GDPR" means Regulation (EU) 2016/679.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country in respect of which a separate transfer mechanism is required under Applicable Data Protection Law.
• "Standard Contractual Clauses" or "SCCs" means the Module 2 (Controller to Processor) standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as may be amended, replaced, or supplemented from time to time.
• "Sub-processor" means any third party engaged by Fuzu to process Customer Personal Data on Fuzu's behalf in connection with the Service.

In respect of Customer Personal Data, the Customer is the controller and Fuzu is the processor, acting on the Customer's documented instructions. This DPA applies only to processing where Fuzu acts as a processor on the Customer's behalf. Where Fuzu acts as an independent controller (for example, in respect of personal data of Candidates who have created their own Fuzu profile and who interact with the Customer through the Service), Fuzu's processing is governed by the Fuzu Privacy Policy and not by this DPA.

Where the parties act as joint controllers in respect of Customer Personal Data, the allocation of responsibilities is set out in the joint-controller arrangement or otherwise agreed in writing.

The subject matter, duration, nature, purpose, types of personal data, and categories of data subjects in respect of the processing under this DPA are set out in Annex I.

Fuzu processes Customer Personal Data only on the documented instructions of the Customer, including with regard to Restricted Transfers, unless required to do so by a law to which Fuzu is subject. The Service Terms, this DPA, the Agreement, and the Customer's use of the configurable features of the Service together constitute the Customer's complete and final instructions to Fuzu in respect of the processing of Customer Personal Data. Any additional or alternative instructions must be agreed in writing between the parties.

Where Fuzu is required by a law to which it is subject to process Customer Personal Data otherwise than in accordance with the Customer's instructions, Fuzu will inform the Customer of that legal requirement before processing, unless prohibited by law.

Fuzu will inform the Customer promptly if, in Fuzu's opinion, an instruction infringes Applicable Data Protection Law. Fuzu is not obliged to act on, and may decline to act on, an instruction that would cause Fuzu to be in breach of Applicable Data Protection Law.

Fuzu ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Fuzu provides such personnel with appropriate training on data protection and information security.

Fuzu implements and maintains the technical and organisational measures set out in Annex II to ensure a level of security appropriate to the risk of the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

Fuzu may update the measures in Annex II from time to time to reflect changes in industry practice or in the Service, provided that the updated measures provide a level of security at least equivalent to the security provided by the measures they replace.

Fuzu does not require the Customer to provide special-category data (also referred to as sensitive personal data under some Applicable Data Protection Laws) to use the Service. Where the Customer or its end-users provide special-category data to Fuzu through the Service, the Customer warrants that it has established a lawful basis under Applicable Data Protection Law for the processing of such data. Fuzu will apply the technical and organisational measures in Annex II to special-category data and, where Fuzu becomes aware of an issue specific to special-category data, will discuss with the Customer additional measures that may be reasonably required.

Fuzu will notify the Customer without undue delay and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known at the time, the information that the Customer reasonably requires to meet its own notification obligations under Applicable Data Protection Law, including:

• a description of the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records affected;
• the name and contact details of Fuzu's DPO or other point of contact;
• a description of the likely consequences of the Personal Data Breach; and
• a description of the measures taken or proposed to address the Personal Data Breach, including measures to mitigate its possible adverse effects.

Fuzu will cooperate with the Customer and provide reasonable assistance to enable the Customer to investigate, mitigate, and remediate the Personal Data Breach and to comply with the Customer's obligations to notify the supervisory authority and affected data subjects, where required by Applicable Data Protection Law.

Fuzu's notification of a Personal Data Breach is not in itself an acknowledgement of fault or liability.

9.1 General authorisation

The Customer provides general written authorisation for Fuzu to engage Sub-processors to process Customer Personal Data, subject to this Clause 9. The current list of Sub-processors is set out in Annex III.

9.2 Changes to Sub-processors

Fuzu will give the Customer at least thirty (30) days' prior notice of the addition or replacement of a Sub-processor, by updating the list at Annex III or by another reasonable communication method. The Customer may object to the addition or replacement of a Sub-processor on reasonable data-protection grounds by notice to Fuzu within fifteen (15) days of receiving the notification. The parties will discuss the objection in good faith and may agree on appropriate measures (for example, configuration changes, additional safeguards, or a workaround). Where the parties cannot agree, the Customer may terminate the affected Services on written notice, subject to the termination provisions of the Agreement.

9.3 Sub-processor obligations

Fuzu will enter into a written agreement with each Sub-processor that imposes on the Sub-processor data-protection obligations substantially equivalent to those imposed on Fuzu under this DPA. Fuzu remains responsible for the performance of each Sub-processor's obligations under that agreement to the same extent as Fuzu would be if it were performing the services itself.

Fuzu will, taking into account the nature of the processing, provide reasonable assistance to the Customer through appropriate technical and organisational measures to enable the Customer to respond to Data Subject Requests and to comply with the Customer's other obligations under Applicable Data Protection Law (including data-protection impact assessments, prior consultations with supervisory authorities, and security obligations).

If a Data Subject Request is made directly to Fuzu in respect of Customer Personal Data, Fuzu will, unless prohibited by law, promptly inform the Customer and will not respond to the request other than to confirm receipt or to redirect the data subject to the Customer, except on the Customer's written instructions or where required by law.

On termination or expiry of the Agreement, or otherwise on the Customer's written request, Fuzu will, at the Customer's choice, delete or return all Customer Personal Data, and delete existing copies, unless Applicable Data Protection Law requires storage of the Customer Personal Data.

Fuzu will complete deletion within ninety (90) days of termination or the Customer's request, unless a longer period is reasonably required for backup deletion cycles. Customer Personal Data retained in backups will continue to be subject to the security obligations in this DPA until it is deleted in the ordinary course of backup expiry.

Where Applicable Data Protection Law requires Fuzu to retain Customer Personal Data, Fuzu will inform the Customer of the legal requirement and the data and processing concerned.

Fuzu will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, in accordance with this Clause 12.

The right to audit may be exercised once per calendar year on at least thirty (30) days' prior written notice, except where an audit is required by the Customer's supervisory authority or follows a Personal Data Breach, in which case shorter notice may apply. Audits will be conducted during business hours, in a manner that does not unreasonably interfere with Fuzu's normal business operations, and subject to reasonable confidentiality undertakings.

Fuzu may satisfy its audit obligations by providing the Customer with copies of relevant third-party audit reports and by responding to reasonable written questions from the Customer in lieu of, or in addition to, an on-site audit, where the parties agree that this is sufficient.

The Customer is responsible for the costs of any audit conducted under this Clause 12, except where the audit reveals a material non-compliance by Fuzu with this DPA, in which case Fuzu will bear the reasonable costs of the audit.

13.1 Transfers from the EEA, the UK, and Switzerland

Where Fuzu transfers Customer Personal Data to a country in respect of which the European Commission has not made an adequacy decision and that is outside the EEA, the UK, or Switzerland, the transfer is subject to the SCCs, which are incorporated into this DPA by reference. The parties agree to the SCCs, Module Two (controller to processor), with Module Two clauses applying as follows:

• Clause 7 (Docking clause): included.
• Clause 9 (Use of sub-processors): Option 2 (general written authorisation) applies, with a notice period of thirty (30) days.
• Clause 11 (Redress): the optional language on independent dispute resolution is not used.
• Clause 17 (Governing law): the SCCs are governed by the law of the Republic of Finland.
• Clause 18 (Choice of forum and jurisdiction): disputes arising from the SCCs will be resolved by the courts of Helsinki, Finland.
• Annex I of the SCCs: corresponds to Annex I of this DPA.
• Annex II of the SCCs: corresponds to Annex II of this DPA.
• Annex III of the SCCs (list of Sub-processors): corresponds to Annex III of this DPA.

13.2 Transfers from the United Kingdom

Where Fuzu transfers Customer Personal Data subject to the UK GDPR to a country in respect of which the UK has not made an adequacy decision, the transfer is subject to the UK International Data Transfer Addendum to the EU SCCs (the "UK Addendum") or the UK International Data Transfer Agreement, as applicable, which is incorporated into this DPA by reference.

13.3 Transfers from Kenya, Uganda, and Nigeria

Where Customer Personal Data subject to the data-protection law of Kenya, Uganda, or Nigeria is transferred outside that country, the transfer is carried out in accordance with the cross-border transfer provisions of the applicable law, as described in the relevant Country Addendum to the Fuzu Privacy Policy. Fuzu will, on request, provide the Customer with information about the transfer mechanism applicable to such transfers.

The liability of each party arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Service Terms and the Agreement. Nothing in this DPA limits or excludes a party's liability where such limitation or exclusion would be unenforceable under Applicable Data Protection Law.

In the event of a conflict or inconsistency between this DPA and the Service Terms or the Agreement, this DPA prevails to the extent of the conflict, but only in respect of the processing of Customer Personal Data. In the event of a conflict or inconsistency between this DPA and the SCCs (where they apply), the SCCs prevail.

This DPA takes effect on the effective date set out at the start of this document and remains in force for as long as Fuzu processes Customer Personal Data on behalf of the Customer. Termination of the Agreement does not relieve either party of obligations that by their nature survive termination, including obligations in this DPA relating to confidentiality, return and deletion of Customer Personal Data, and assistance with regulatory requests.

This DPA is governed by the law of Finland, except that the SCCs (where they apply) are governed by the law of Finland in accordance with Clause 13.1 above. The Country Addenda to the Service Terms apply in respect of mandatory rights under local law.

A. Data Exporter

B. Data Importer

C. Description of the processing and transfer

D. Competent supervisory authority

In accordance with Clause 13 of the SCCs (Module Two), the competent supervisory authority for the data exporter is the supervisory authority of the data exporter's place of main establishment in the EEA. Where the data exporter is not established in the EEA but falls within the territorial scope of the GDPR by virtue of Article 3(2), the competent supervisory authority is the Office of the Data Protection Ombudsman of Finland. For Customer Personal Data subject to the Kenya DPA, the competent authority is the Office of the Data Protection Commissioner (Kenya); for the Uganda DPPA, the Personal Data Protection Office (Uganda); for the Nigeria DPA, the Nigeria Data Protection Commission.

The following list sets out the Sub-processors engaged by Fuzu in connection with the Service. The list was compiled from the Fuzu codebase in May 2026 and is updated in accordance with Clause 9.2. The current and authoritative list is available on the sub-processors page.

Self-hosted infrastructure components running inside Fuzu's own cluster (including PostgreSQL, Redis, Elasticsearch, Sidekiq, the Flipper feature-flag store, and the Ahoy first-party server-side analytics layer) are not listed separately as Sub-processors — they run on the cloud-hosting Sub-processor listed in row 1 of the table and are governed by that relationship. Social-login providers (Google, Facebook, and LinkedIn OAuth for the Fuzu brand, and Microsoft Azure AD B2C for the Barona white-label brand) are not Sub-processors of Fuzu — they act as independent controllers or identity providers under their own terms when a User chooses to use them.

Categories not currently engaged. For transparency, the following categories of service have been checked against the Fuzu codebase and no Sub-processor is currently engaged in any of them:

• Dedicated identity-verification or KYC providers (such as Onfido, Veriff, or Smile Identity). Identity-related processing for Fuzu Atlas engagements, where it occurs, is handled internally or against the relevant government registry (for example, the Nigeria National Commission for Persons with Disabilities (NCPWD) registry for disability-status validation). Where Fuzu engages a dedicated identity-verification Sub-processor in the future, the list above will be updated in accordance with Clause 9.2 of the DPA.
• Third-party push-notification vendors. Push notifications are delivered through the open Web Push standard using self-managed VAPID keys, not through a third-party push provider.
• Alternative payment providers (such as Stripe, Paystack, Flutterwave, or Pesapal). Payments are processed exclusively through 3G DirectPay.
• Alternative analytics and monitoring providers (such as Hotjar, Mixpanel, Segment, Amplitude, Sentry, or Datadog). Analytics, monitoring, and observability are limited to the Sub-processors listed above.

This DPA may be executed by signature of the Customer and Fuzu, by clickwrap acceptance through the Service, or by reference to this DPA in an Order Form executed by the parties. The effective date of this DPA is the effective date set out at the start of this document or, if later, the date of the Customer's first acceptance or use of the Service following the publication of this DPA.

Signed for and on behalf of the Customer:

Name: ____________________________

Title: ____________________________

Date: ____________________________

Signed for and on behalf of Fuzu Ltd:

Name: ____________________________

Title: ____________________________

Date: ____________________________