Data Processing Addendum for Customer Assurance

This Data Processing Addendum ("DPA") forms part of the agreement between MatchAudit UG (haftungsbeschränkt) ("MatchAudit" or "Processor") and the business customer using the Service ("Customer" or "Controller"), including the Customer Assurance subscription terms.

This DPA applies only to the extent MatchAudit processes personal data on behalf of the Customer in order to provide the Service.

• For all content the Customer and its authorised users place in a Customer Assurance workspace, the Customer acts as controller and MatchAudit acts as processor. This includes questionnaires, requirements, evidence documents, answers, customer contacts, the internal experts the Customer asks for evidence, and the emails the Customer's users send from the workspace.
• For customer-uploaded screening data and related workflow data, the Customer generally acts as controller and MatchAudit generally acts as processor.
• For MatchAudit's own account administration, billing, fraud prevention, abuse prevention, service security, and legal compliance activities, MatchAudit acts as controller. Those activities are not governed by this DPA; the Privacy Notice describes them.

The subject matter of the processing is the provision of the contracted Service. The processing for Customer Assurance is described in Annex 1 Part A; the processing for screening and Evidence Hub in Annex 1 Part B.

Processing begins when the Customer or its users first submit personal data to the Service. It continues for the term of the relevant subscription and the export period in Section 14, unless terminated earlier under the main agreement or this DPA.

In the event of conflict between this DPA and the main agreement, this DPA prevails with respect to data protection matters. Where standard contractual clauses apply, they prevail over this DPA.

The nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1. The categories of personal data processed are determined by what the Customer and its users submit.

The Service is not designed for special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). The Customer shall not submit such data unless it has assessed that the processing is lawful; MatchAudit does not review submitted content for such data.

MatchAudit shall process personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which MatchAudit is subject. In that case MatchAudit shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Customer's use of the Service, its account configuration, API calls, uploads, exports, administrative choices, the actions its authorised users start in the workspace (such as sending an evidence request to an expert), and written support instructions constitute documented instructions.

MatchAudit shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. MatchAudit may suspend carrying out that instruction until the Customer confirms or changes it.

The Customer remains responsible for:

• determining whether personal data may lawfully be processed and submitted to the Service, and establishing the legal basis, purpose, and scope of processing;
• providing the information required by Articles 13 and 14 GDPR to the persons whose data it submits, including its own personnel whom it names as experts and the contacts at its customers, and handling data subject requests as controller;
• keeping contact details it enters accurate, and entering email addresses only of persons it may contact for the stated purpose;
• where it has a works council, assessing before use whether introducing the Customer Assurance workflow, which records which employee was asked for evidence and when, is subject to co-determination under § 87(1) no. 6 of the German Works Constitution Act (BetrVG), or under comparable rules elsewhere;
• assessing whether any special-category data, criminal-offence data, or other restricted data may lawfully be processed;
• reviewing AI-prepared drafts before it relies on or shares them, and ensuring that its instructions do not violate applicable law.

MatchAudit shall:

• process personal data only in accordance with the Customer's documented instructions and applicable law;
• ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• take all measures required under Article 32 GDPR, as described in Section 9;
• respect the conditions in Section 10 for engaging subprocessors;
• assist the Customer, taking into account the nature of the processing and the information available to MatchAudit, with the obligations under Articles 32 to 36 GDPR;
• maintain a record of processing activities carried out on behalf of the Customer as required by Article 30(2) GDPR;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed under this DPA;
• make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allow for and contribute to audits as described in Section 15.

AI assistance

Customer Assurance uses an AI service provider, named in the subprocessor list, to read uploaded questionnaires and evidence, sort questions by control, suggest which team can answer them, and prepare draft answers with links to their sources. Personal data contained in that content is processed only for these functions and only on the Customer's instructions.

• MatchAudit does not use Customer personal data to train AI models.
• AI output is a draft for the Customer. Nothing is shared with the Customer's own customers automatically; a person at the Customer starts every share and every export.
• Every Customer Assurance function can also be used manually, without AI drafting.

Emails sent from the workspace

When an authorised user sends an evidence request to an internal expert, or a message to a contact at one of the Customer's customers, MatchAudit transmits that email on the Customer's instruction through the email providers named in the subprocessor list.

• Emails to experts and customer contacts are sent only when a user starts them; MatchAudit sends them no reminders or follow-ups on its own.
• Each email names the sending user and the Customer's organisation and says why the recipient received it. Replies go directly to the sending user, not to MatchAudit.
• MatchAudit keeps a record of each email (recipient, subject, text, sending user, time, and delivery status) as part of the Customer's workspace records, so the Customer can show what it requested.
• MatchAudit does not use these recipients' details for its own purposes, including marketing.
• Removing an expert from the workspace deletes that expert's name, email address, and the records of emails sent to them. Evidence files remain in the Customer's Evidence library.
• The sandbox (trial) workspace never sends email.

Instead of sending through MatchAudit, a user can open the drafted request in their own email program. MatchAudit does not process emails sent that way.

MatchAudit shall ensure that access to personal data is limited to personnel, contractors, subprocessors, and service providers who need such access in order to provide, secure, maintain, or support the Service.

Such persons shall be subject to confidentiality obligations, statutory duties, or professional secrecy obligations appropriate to the nature of the data and the processing. These obligations continue after their engagement ends.

MatchAudit implements technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing. For Customer Assurance these measures include:

• separation of each customer organisation's data in the database through row-level security rules scoped to that organisation;
• role-based access within the workspace: owners and administrators decide who can view or edit the evidence library;
• authentication for every workspace request and encryption in transit;
• an audit trail of changes to evidence, answers, experts, and sharing decisions;
• a malware scan of every uploaded file before it is stored;
• server-side records of sent emails that cannot be created or altered by workspace users, and limits on the number of emails that can be sent;
• logging, monitoring, backup and recovery procedures, and least-privilege principles;
• change management and vulnerability management practices reasonably appropriate to the Service.

MatchAudit may update or replace such measures from time to time, provided that the overall level of security for the processor services is not materially reduced.

The Customer grants MatchAudit a general written authorisation to engage subprocessors for the provision of the Service. The current subprocessors, their purpose, and their location are listed at matchaudit.io/subprocessors.

MatchAudit shall impose on each subprocessor, by contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. MatchAudit remains fully liable to the Customer for the performance of its subprocessors' obligations.

MatchAudit will give notice of an intended addition or replacement of a subprocessor at least 30 days before that subprocessor begins processing Customer personal data, unless an urgent security or legal requirement makes advance notice impracticable.

If the Customer objects to a new subprocessor on documented data protection grounds within the 30-day notice period, the parties will discuss the objection in good faith. If no reasonable solution can be reached, the Customer may terminate the affected services before the change takes effect.

The primary database for Customer Assurance is hosted in the European Union. Some subprocessors process personal data outside the European Economic Area, as shown in the subprocessor list.

Where required by applicable law, MatchAudit shall ensure an appropriate transfer mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses.

Where MatchAudit relies on standard contractual clauses, it shall document a transfer assessment covering the relevant data, destination, importer, access risks, onward transfers, and any supplementary contractual, technical, or organisational measures. MatchAudit shall re-evaluate the assessment when a material change affects the transfer.

Taking into account the nature of the processing, MatchAudit shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Chapter III GDPR. In Customer Assurance, the Customer can itself view, correct, export, and delete the records it controls, including removing an expert or a contact.

If a data subject contacts MatchAudit directly about data processed under this DPA, MatchAudit shall forward the request to the Customer without undue delay and shall not respond on its own except on the Customer's instruction.

MatchAudit shall also provide reasonable assistance, to the extent required by law and taking into account the information available to MatchAudit, with:

• security incident assessment and notification obligations;
• data protection impact assessments;
• consultations with supervisory authorities;
• regulatory or audit requests related to processor services.

MatchAudit may charge for significant additional effort that falls outside standard service support, unless the assistance is needed because of MatchAudit's own breach of this DPA.

If MatchAudit becomes aware of a personal data breach affecting personal data processed under this DPA, MatchAudit shall notify the Customer without undue delay, so that the Customer can meet its obligations under Articles 33 and 34 GDPR.

Such notification shall include, to the extent available at the time, a description of the nature of the breach, the categories and approximate number of affected data subjects and records, the likely consequences, the measures taken or proposed to address the breach, and a contact point. Information not available at first is provided as it becomes available.

At the end of the relevant processor services, MatchAudit shall, at the Customer's choice, return or delete the personal data processed under this DPA. The Customer exercises the return option by exporting its Customer Assurance and Evidence Hub records and uploaded files during a 30-day period after the end of the services. After that period, MatchAudit shall delete the active storage and database copies unless Union or Member State law requires storage. Customer-configured schedules for individual evidence records remain subject to a maximum of 10 years.

During the services, the Customer can delete individual records itself. Residual backup copies are isolated from ordinary use, remain protected by the confidentiality and security obligations in this DPA, and are deleted or overwritten under the documented backup rotation. Legal holds apply only where required and are lifted when the relevant obligation ends.

MatchAudit shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to the following conditions:

• reasonable prior written notice;
• no more than once in any twelve-month period unless a personal data breach, a supervisory authority, or reasonable indications of non-compliance justify more frequent review;
• use of questionnaires, certifications, summaries, and remote reviews first, where they are sufficient to answer the audit's purpose;
• auditors bound by confidentiality, and not competitors of MatchAudit;
• no access to data of other customers or to information that would compromise the security or confidentiality of the Service;
• the Customer bearing its own costs and reimbursing MatchAudit for substantial additional time or expense caused by non-standard audit requests, unless the audit reveals a material breach by MatchAudit.

Liability between the parties under this DPA shall be governed by the liability provisions of the main agreement, except to the extent mandatory data protection law requires otherwise. Article 82 GDPR remains unaffected.

This DPA does not expand MatchAudit's role beyond processor obligations required by applicable law and does not transfer the Customer's underlying compliance, due-diligence, screening, or controller responsibilities to MatchAudit. Customer Assurance provides evidence and workflow; the Customer remains responsible for the answers it gives to its customers.

MatchAudit UG (haftungsbeschränkt)
Turmstrasse 7, 65611 Brechen, Germany
Commercial register: Amtsgericht Limburg a.d. Lahn, HRB 7665

DPA, privacy, and procurement inquiries: info@matchaudit.io.

Part A — MatchAudit Customer Assurance

Subject matter and purpose: providing the Customer Assurance workspace, in which the Customer receives and organises due-diligence questionnaires, requirements and contracts from its own customers; collects evidence from its internal experts; prepares, reviews and exports answers; and records what it shares.

Nature of the processing:

• receiving, storing, classifying, and extracting content from uploaded questionnaires, contracts, and evidence documents;
• AI-assisted sorting of questions by control, team suggestions, and drafting of answers with links to their sources;
• recording the internal experts the Customer assigns to controls, and sending evidence requests to them when a user starts it;
• sending messages to the Customer's customer contacts when a user starts it, for example about an incident;
• exporting completed questionnaires and evidence, and keeping an audit trail of changes and sharing decisions;
• hosting, securing, backing up, troubleshooting, and supporting the Service.

Types of personal data:

• Internal experts: name, business email address, team, the controls they were asked about, request and receipt dates, and the emails sent to them;
• Contacts at the Customer's customers: name, organisation, role, business email address, phone number, notes the Customer records, and messages sent to them;
• Workspace users: name, business email address, and the actions they take (such as uploads, edits, approvals, and shares);
• Content of documents and answers: any personal data contained in questionnaires, contracts, evidence files, and answers, such as names and roles of staff, signatories, auditors, or contact persons;
• related metadata, timestamps, and workflow history.

Categories of data subjects: the Customer's employees and contractors (workspace users and internal experts); personnel at the Customer's customers who send or receive requirements; and other individuals named in documents the Customer uploads.

Special categories: not intended; see Section 3.

Duration: the term of the Customer Assurance subscription and the 30-day export period in Section 14. Expert and contact details are deleted earlier when the Customer removes them.

Location: primary database in the European Union; subprocessors and their locations as listed at matchaudit.io/subprocessors.

Part B — MatchAudit screening and Evidence Hub

Nature and purpose: receiving, importing, structuring, and storing screening data uploaded by the Customer; comparing names and related identifiers against sanctions data and other configured compliance datasets; generating potential matches, case records, reports, exports, and audit-trail entries; and supporting customer-configured retention, deletion, retrieval, access control, and workflow settings.

Types of personal data:

• names of natural persons and legal entities;
• aliases, transliterations, and related identity fields;
• dates of birth, nationality, addresses, and country data;
• KYC, onboarding, counterparty, vendor, customer, or beneficiary records;
• case notes, analyst annotations, decision records, and evidence files;
• related metadata, timestamps, and workflow history generated through use of the Service.

Categories of data subjects: customers, counterparties, vendors, beneficial owners, directors, authorised signatories, beneficiaries, employees, or other individuals whose data the Customer decides to screen or manage through the Service.

Duration and location: as in Part A, for the term of the relevant subscription.