Data Processing Addendum

This Data Processing Addendum (“DPA”) forms an integral part of the agreement between Cathrix Network Inc. (“Cathrix”) and the Customer when Cathrix processes Customer Personal Data on Customer’s behalf.

1. Scope, Roles, and Legal Compliance

1.1 Scope and Roles

• Roles: Customer is the Data Controller (or “Business” / “Data User” / “Personal Information Handling Entity”), and Cathrix is the Data Processor (or “Service Provider” / “Data Processor” / “Entrusted Party”) under applicable data protection legislation.
• Scope: Applies solely to personal information contained within Customer Content (“Customer Personal Data”). Cathrix’s handling of direct account, billing, and system access telemetry is governed independently by our Privacy Policy.

1.2 Service Provider Commitments

To the extent applicable privacy legislation governs the processing:

• Cathrix acts strictly as a Service Provider/Processor and will not sell or share Customer Personal Data (including for cross-context behavioural advertising).
• Cathrix will not retain, use, or disclose Customer Personal Data for any purpose other than providing the Services, executing anti-fraud and security checks, or as otherwise permitted by law.
• Cathrix will not combine Customer Personal Data with personal information received from other sources, except to perform permitted business functions authorized under applicable regulations.
• Cathrix provides a comparable level of data protection and allows reasonable verification of compliance.

2. Processing and Security Safeguards

2.1 Permitted Instructions and Risk Control

Cathrix will process Customer Personal Data exclusively pursuant to Customer’s documented instructions, to deliver the Services, and to maintain infrastructure integrity. Cathrix may process associated network telemetry and device fingerprints solely to prevent fraud, credential abuse, automated bots, and security incidents.

2.2 Security Measures

Cathrix maintains reasonable technical, physical, and administrative safeguards designed to protect Customer Personal Data against accidental loss, unauthorized access, or alteration, including network encryption (TLS/AES), credential isolation, and role-based access controls.

2.3 Customer Data Incidents

In the event of a confirmed breach of security safeguards involving Customer Personal Data (“Customer Data Incident”):

• Cathrix will notify Customer without undue delay, and in any event within 72 hours of confirming a Customer Data Incident.
• Cathrix will supply available details regarding the nature of the breach, affected records, and remediation steps taken.
• Customer retains responsibility for statutory reporting to regulatory authorities and notifying affected individuals, with reasonable support provided by Cathrix.

3. Data Storage Locations and Subprocessors

3.1 Geographic Storage Restrictions and Cross-Border Transfers

All primary hosting, cold backups, and database storage for Customer Personal Data are located exclusively in Canada and the United States. Data is not transferred to or stored in other jurisdictions without written authorization. Customer represents and warrants that it has provided all statutory notices and obtained all necessary consents required under applicable privacy legislation for transferring and storing Customer Personal Data in Canada and the United States.

3.2 Authorized Subprocessors

Customer provides general authorization for Cathrix to engage qualified subprocessors. All subprocessors are bound by written agreements imposing data-protection obligations at least as stringent as those in this DPA. Cathrix remains responsible for subprocessor acts and omissions. Current authorized subprocessors are listed in Schedule B.

3.3 Subprocessor Changes

Cathrix will notify Customer of any planned additions or replacements to the subprocessor list via email or administrative portal update. Customer may object on reasonable data-protection grounds in writing within 14 calendar days of notification. If unresolved, Customer may terminate the affected Services without penalty.

4. Assistance, Data Rights, and Termination

4.1 Data Subject Inquiries

Taking into account the nature of processing, Cathrix will provide reasonable technical assistance to help Customer respond to individual requests to access, rectify, delete, export (portability), or limit processing of their personal information.

4.2 Deletion or Return

Upon termination of the Services, Customer is responsible for retrieving Customer Personal Data. Cathrix will permanently delete or overwrite Customer Personal Data within 30 days of termination, save for routine, encrypted disaster-recovery backups which are automatically overwritten according to standard retention schedules not exceeding 90 days.

---

Schedule A: Processing Details

1. Subject Matter and Nature: Provision of network, hosting, and cloud infrastructure services.
2. Duration: The term of the Services plus post-termination backup overwrites.
3. Data Categories: Information transmitted through or stored in Customer Content, which may include IP addresses, account identifiers, communication content, transaction logs, and technical headers.
4. Data Subjects: Customer’s authorized personnel, customers, end-users, or visitors.

---

Schedule B: Authorized Subprocessors