DATA PROCESSING AGREEMENT (DPA)

Last Updated: October 26, 2026

This Data Processing Agreement (the “Agreement”) takes effect between the Supplier and the Licensee on the earlier of: (a) the effective date of the Main Agreement or amendment incorporating this Agreement by reference; (b) the date the Licensee expressly accepts this Agreement electronically; or (c) the date the Licensee first accesses or uses the Software or Services (the “Effective Date”). By accessing or using the Software or Services, the Licensee agrees to be bound by this Agreement without requiring a separate signature or other express acceptance. Any person accessing or using the Software or Services on behalf of the Licensee represents that they have authority to bind the Licensee. Subsequent amendments to this Agreement shall be governed by Clause 10.4.

paytech ltd, a company duly incorporated and registered in Cyprus with Registration Number HE 440168, having its registered office at Archiepiskopou Makariou III, 84, OFFICE 1, 6017, Larnaca, Cyprus (the “Supplier"), and

Application and Binding Effect. This Agreement applies to each business customer receiving or using the Supplier’s Software or Services (the “Licensee”), irrespective of whether that customer is designated as a licensee, client, customer or otherwise. The “Main Agreement” means the Software License Agreement, Payment Gateway Software Services Agreement or other contractual terms governing the Supplier’s provision of the Software or Services to the Licensee, including applicable schedules and annexes. This Agreement becomes binding through any of the acceptance methods specified in its opening paragraph and governs the Supplier’s processing of Personal Data on the Licensee’s behalf, whether the Licensee acts as controller or processor. The Supplier and the Licensee are each a “Party” and together the “Parties”.

RECITALS:

WHEREAS, the Parties have entered into a Software License Agreement, a Payment Gateway Software Services Agreement or other customer agreement (the “Main Agreement”) that either expressly incorporates this Agreement by reference or that the Parties wish to supplement by entering into this Agreement. References to the Main Agreement include its applicable schedules, annexes and amendments.

WHEREAS, the Parties wish to enter into this Agreement to govern the processing of Personal Data in connection with the Software and Services, including Personal Data relating to the Licensee’s customers and other third parties, in compliance with Regulation (EU) 2016/679 (the “GDPR”), the Cyprus Personal Data Processing Law of 2018 (Law 125(I)/2018), and other applicable data protection laws and regulations.

WHEREAS, this Agreement supplements and forms part of the Main Agreement and may be amended in accordance with Clause 10.4.

NOW, THEREFORE, in consideration of the mutual covenants and promises contained herein, the Parties hereto agree as follows:

1. DEFINITIONS

1.1. Applicable Law means all relevant legislation, including but not limited to the GDPR, the Cyprus Personal Data Processing Law of 2018 (Law 125(I)/2018), and other applicable data protection laws and regulations.

1.2. Data Controller means the entity that determines the purposes and means of processing Personal Data.

1.3. Data Processor means the entity that processes Personal Data on behalf of the Data Controller.

1.4. Data Subject means an identified or identifiable natural person whose Personal Data is processed under this Agreement.

1.5. GDPR means the General Data Protection Regulation (EU) 2016/679.

1.6. Personal Data means any information relating to an identified or identifiable natural person that is processed under the Main Agreement.

1.7. Processing means any operation or set of operations performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.

1.8. Software means the software licensed or made available under the Main Agreement. Services means the services provided under the Main Agreement, including, where selected, NetworkToken services for provisioning, using and managing payment network tokens, and 3-D Secure 2 (3DS2) services for cardholder authentication and transmission of authentication results through the Software. This Agreement does not activate or extend any service or change its fees.

1.9. Sub-Processor means any third party engaged by the Supplier to process Personal Data on the Licensee’s behalf, including a provider integrated into the Software where it performs that role. A party’s role is determined by its actual processing activities, not its designation in a commercial arrangement.

2. SUBJECT MATTER

2.1. This Agreement governs the processing of Personal Data in connection with the Main Agreement.

2.2. The key objective in this regard is to ensure compliance with the Applicable Law concerning the protection of natural persons with regard to the processing of Personal Data. Such compliance, as well as the related provisions and practices, shall reflect the intention of the Parties as reflected in this Agreement, to safeguard the protection of privacy and the fundamental human rights and freedoms of Data Subjects as defined in all Applicable Law.

3. ROLES OF THE PARTIES

3.1. The Licensee acts as Data Controller or, where it processes Personal Data on behalf of another controller, as Data Processor. The Supplier acts respectively as Data Processor or Sub-Processor for the processing performed on the Licensee’s behalf. Where the Licensee is a Data Processor, it shall ensure that it has the relevant controller’s authority to give the instructions and authorizations contemplated by this Agreement and shall communicate applicable upstream requirements to the Supplier before the affected processing begins. The Supplier will process Personal Data only on documented instructions from the Licensee, including with regard to transfers to a third country or international organization, unless required by Union or Member State law to which the Supplier is subject, subject to Clause 5.1.

3.2. Independent Controller Activities. The Supplier may act as an independent Controller in respect of Personal Data it processes for its own business purposes, limited to the following:

(a) Ensuring the security and integrity of the Supplier’s Software and systems, including detecting misuse, security threats or fraud;

(b) Meeting applicable legal or regulatory obligations, including financial reporting and compliance;

(c) Performing analytics and improving the Software and Services as expressly permitted under Clause 3.3; and

(d) Administering the Supplier’s own business relationship with the Licensee, including business contacts, contracting, billing and account administration, using only the relevant business contact and administration data. This does not authorise reuse of the Licensee’s cardholder or transaction data for unrelated purposes.

The Supplier acts as an independent Controller only to the extent that it independently determines the purposes and essential means of the relevant processing. Processing performed on the Licensee’s behalf, including security activities undertaken on its behalf, remains subject to the Supplier’s obligations as Processor or Sub-Processor. The Supplier shall be responsible for establishing an applicable lawful basis and satisfying its other obligations as Controller before commencing independent-controller processing.

This Clause does not authorise the sale of Personal Data or its unauthorised disclosure to third parties. Service providers engaged for the Supplier’s own permitted purposes must be subject to appropriate data protection and confidentiality obligations. Neither the Supplier nor those providers may use the Personal Data to train or fine-tune AI or machine-learning models under this Agreement.

3.3. Independent Analytics and Service Improvement. The Licensee authorizes the Supplier to process Personal Data relating to the use and technical performance of the Software and Services, including transaction status and routing information, technical logs, error records, response times and usage statistics, for the Supplier’s own purposes of identifying technical issues, evaluating service performance and developing and improving the functionality, reliability and efficiency of its Software and Services. The Supplier may use AI-assisted tools for these purposes.

To the extent that the Supplier independently determines the purposes and essential means of such processing, it shall act as an independent Controller and shall be responsible for complying with the obligations applicable to it in that capacity. This authorization does not change the Supplier’s role as Processor or Sub-Processor for processing performed on the Licensee’s behalf.

The Supplier shall use only data necessary for these purposes and shall use anonymous or aggregated information where it meets the purpose. Pseudonymised data remains Personal Data. Independent analytics shall exclude full card numbers, usable network token values, payment cryptograms, authentication secrets and 3DS authentication values. Where AI-assisted tools receive Personal Data, the Supplier must first establish the appropriate provider terms, security and transfer safeguards. This Clause does not authorise sale of Personal Data, advertising profiles concerning individuals, or training or fine-tuning AI models using the Personal Data.

3.4. Payment Ecosystem Recipients. On the Licensee’s documented instructions, Personal Data may be transmitted to or received from the relevant merchants, PSPs, acquirers, processors, card schemes, token service providers, issuers and authentication providers for the agreed flow. Such parties may act as processors, independent controllers or, where the legal criteria are met, joint controllers. They are not automatically the Supplier’s Sub-Processors. The Supplier shall identify the relevant recipients and roles for the agreed flow before activation and apply Clause 6 where it engages a Sub-Processor. Any required controller-to-controller or joint-controller arrangements and notices must be in place before the relevant disclosure. This Clause does not authorise unrelated disclosure or independent reuse.

4. DATA PROCESSING

4.1. Scope and Purpose of Processing. The Supplier shall process Personal Data on the Licensee’s behalf to provide, maintain, support and secure the Software and selected Services, and to perform improvements within the Licensee’s documented instructions. For NetworkToken, this includes registering merchants and token requestors, requesting token provisioning, retrieving token data and transaction cryptograms where required, transmitting data to the instructed payment connections, and managing token status and lifecycle events. Lifecycle events are notifications or changes concerning a token or its associated card, including expiry updates, card replacement, suspension, reactivation and deletion. For 3DS2, processing includes merchant registration, initiating and supporting frictionless and challenge flows, and receiving, displaying and transmitting authentication results for the agreed payment flow. Non-payment authentication is included only where enabled under the Main Agreement. Related back-office administration, history, troubleshooting and support are included to the extent necessary. The Supplier’s independent-controller processing is governed by Clauses 3.2 and 3.3.

4.2. Types of Personal Data. When processing Personal Data on the Licensee’s behalf, only the following categories shall be processed to the extent necessary for the Services selected under the Main Agreement:

(a) Identification and business contact data, including names, addresses, email addresses, telephone numbers, user identifiers and merchant or token-requestor registration details, to the extent they relate to natural persons;

(b) Technical and usage data, including IP addresses, device, browser and app information, authentication-session identifiers, access logs, error records and usage statistics;

(c) Transaction and payment data, including references, amounts, currencies, timestamps, status and routing information; cardholder and card details, including PAN and expiry where required; network token values, references, expiry, status, payment account references and lifecycle records; and 3DS2 request, challenge and result data, including ECI, CAVV/AAV or equivalent authentication values and directory-server transaction identifiers, where required for the agreed flow. Transaction cryptograms are handled only as specified in Clause 4.6;

(d) Other specifically identified data required for an agreed compliance function, as described in the Main Agreement or a written processing instruction accepted by the Parties. Special-category data and criminal-conviction or offence data shall not be intentionally included unless their categories, lawful processing conditions and safeguards are expressly agreed. This Agreement does not authorise storage prohibited by applicable payment-card security requirements, including retention of card verification codes after authorisation. Issuer authentication secrets, such as passwords or one-time passcodes, must not be retained in Supplier logs or back-office records.

4.3. Data Subjects. The Personal Data processed relates to the following categories of Data Subjects:

(a) The Licensee’s customers, downstream PSPs, merchants and end-users, and their customers or end-users at each authorised downstream level, including cardholders, to the extent they are natural persons whose data is processed for the selected Services; and

(b) Representatives, employees, contractors and authorised users of the Licensee and its downstream customers and merchants.

4.4. Nature and Duration. Processing consists of receipt, recording, organisation, hosting, storage, retrieval, consultation, updating, authorised transmission, reporting, analysis, restriction, return and deletion for the purposes in Clause 4.1 and the duration in Clause 9.1. The Main Agreement and this Agreement constitute documented instructions. Necessary additional processing details, recipients, retention settings or restrictions may be agreed by authorised representatives in writing, including by email or an electronic project-management or communication system agreed by the Parties, before the relevant processing begins. Such operational instructions do not amend fees, liability or other contractual terms.

4.5. Service Analytics and AI Tools. The Licensee instructs the Supplier to analyse transaction and authentication outcomes, technical errors, latency and service reliability to diagnose faults and improve the Services supplied to the Licensee. Automated or AI-assisted tools may be used subject to Clause 6 for Sub-Processors and Clause 8 for transfers, using only necessary data, with aggregation or pseudonymisation where appropriate, client access separation and suitable review of outputs. Full card numbers, usable network token values, transaction cryptograms, authentication secrets and 3DS authentication values must be excluded from AI inputs and diagnostic logs. Neither the Supplier nor its Sub-Processors may use the Personal Data to train or fine-tune AI models. Independent analytics are governed by Clause 3.3.

4.6. Payment Credentials and Retention. Network token values and linked identifiers remain Personal Data where individuals are identifiable. Tokenisation is not, by itself, anonymisation. Tokenisation does not necessarily delete the underlying PAN. Network Token transaction cryptograms shall be transmitted securely, used only for the relevant transaction and not persistently stored, logged or reused. 3DS2 authentication values are distinct from those cryptograms and may be transmitted and retained only as necessary for the agreed processing and evidence purposes, under applicable security and payment-network requirements. Before activation, the Parties shall document the necessary retention periods or objective deletion criteria for token records, lifecycle histories, authentication evidence, logs and backups. No indefinite retention is authorised.

5. SUPPLIER'S OBLIGATIONS

5.1. Instructions & Infringing Instructions. The Supplier shall only process Personal Data on documented instructions received from the Licensee unless required by Union or Member State law to which the Supplier is subject. In such a case, the Supplier shall notify the Licensee of the legal requirement before processing unless that law prohibits notification on important grounds of public interest. Furthermore, the Supplier shall immediately inform the Licensee if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. The Supplier may suspend affected processing to the extent necessary to avoid infringement while the Parties resolve the issue.

5.2. Legal Basis. In cases where the Supplier acts as a Controller under Clause 3.2 or 3.3, it shall ensure that there is a valid legal basis for such processing pursuant to the GDPR. It shall also meet its applicable transparency, purpose-limitation, data-subject rights and other controller obligations for that processing.

5.3. Confidentiality. The Supplier shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Disclosure of the Licensee’s confidential information to a Sub-Processor duly authorized under Clause 6 is permitted under the Main Agreement’s confidentiality provisions solely to the extent necessary for the authorized processing and subject to appropriate confidentiality obligations. This permission does not authorize unrelated use or disclosure or override separately agreed restrictions.

5.4. Security of Processing. The Supplier shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, but not limited to, encryption, pseudonymization, and regular testing, assessment, and evaluation of the effectiveness of such measures. These measures shall include appropriate access controls and authentication, client separation, secure credential management, vulnerability management, incident response, backup and recovery controls and retention/deletion procedures. The Supplier shall provide a description of the measures applicable to the selected Services before processing begins; the version identified in the Main Agreement or agreed processing schedule forms part of this Agreement. Updates shall not materially reduce the agreed protection. AI-related controls shall prevent optional feedback or data-sharing functions from authorizing model training on the Licensee’s Personal Data.

5.5. Data Breach Notification. The Supplier shall notify the Licensee without undue delay and, in any event, within forty-eight (48) hours after becoming aware of a Personal Data breach affecting data processed on its behalf. The notice shall describe, so far as known, the breach, the categories and approximate numbers of affected individuals and records, likely consequences, measures taken or proposed, and a contact for further information. Missing information shall follow in phases without undue further delay. Notice shall be sent to the Licensee’s designated incident contact or, if none has been designated, through the Main Agreement’s notice channel. The Supplier shall take appropriate containment and remedial measures and cooperate with the Licensee. Notification is not, by itself, an admission of liability.

5.6. Assistance with DPIAs and Authority Consultations. Taking into account the nature of processing and the information available to the Supplier, the Supplier shall assist the Licensee in ensuring compliance with the obligations pursuant to GDPR Articles 32 to 36, specifically regarding security of processing, data breach notifications, Data Protection Impact Assessments (DPIAs), and prior consultations with supervisory authorities.

5.7. Audit and Inspection Rights. The Supplier shall make available to the Licensee all information necessary to demonstrate compliance with the obligations laid down in this Agreement and Article 28 of the GDPR. Furthermore, the Supplier shall allow for and contribute to audits, including inspections, conducted by the Licensee or another independent auditor mandated by the Licensee.

5.8. Deletion or Return of Personal Data. Upon termination or expiration of the Services involving the processing of Personal Data, the Supplier shall, at the Licensee’s choice, delete or return the Personal Data processed on its behalf and securely delete remaining copies within thirty (30) days, unless Union or Member State law requires storage. This obligation extends to copies held by Sub-Processors. Any longer period required for deletion from backups must be expressly agreed in writing, specify a maximum retention period and restrict retained data to storage and necessary recovery operations, with deletion instructions reapplied following restoration. Retained data shall remain subject to this Agreement until deleted.

6. SUB-PROCESSORS

6.1. Sub-processor Engagement & Right to Object. The Licensee provides general written authorization for the Supplier to engage Sub-Processors to process Personal Data on its behalf. The Supplier shall provide and maintain an up-to-date list identifying their legal entities, functions and processing locations. The list shall include relevant integrated tokenisation and 3DS2 providers and the further processing chain as required by Applicable Law; the absence of a direct Licensee contract does not remove these requirements.

The Supplier shall give direct written notice through the Main Agreement’s notice channel of intended additions or replacements at least fifteen (15) calendar days before access. A website update alone is insufficient. The Licensee may object within that period on reasonable data protection grounds. The Parties shall seek a reasonable resolution, and the proposed Sub-Processor shall not process the objecting Licensee’s data pending resolution. If unresolved, the Supplier may retain an alternative arrangement or either Party may terminate only the affected Services on written notice. No early termination penalty applies to those Services, and unused prepaid recurring fees for them shall be refunded. Broader termination rights under the Main Agreement or Applicable Law remain unaffected.

6.2. Liability for Sub-processors. Where the Supplier engages a Sub-processor, the same data protection obligations as set out in this Agreement shall be imposed on that Sub-processor by way of a contract. The Supplier shall remain fully liable to the Licensee for the performance of the Sub-processor’s obligations.

7. LICENSEE'S OBLIGATIONS

7.1. Compliance. The Licensee shall ensure that its instructions to the Supplier for the processing of Personal Data comply with the GDPR and other Applicable Law. Where it acts as controller, the Licensee shall establish the necessary lawful basis and provide required information to Data Subjects. Where it acts as processor, it shall ensure that the relevant controller has authorized the processing and that its instructions are supported by the required upstream authority. Each Party remains responsible for its own obligations under Applicable Law.

7.2. Data Subject Rights. The Licensee shall be responsible for responding to requests from Data Subjects regarding the exercise of their rights under the GDPR. Taking into account the nature of the processing, the Supplier shall assist the Licensee by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Licensee's obligation to respond to requests for exercising the Data Subject's rights. Where the Licensee acts as processor, it shall coordinate with the relevant controller. The Supplier shall promptly forward relevant requests received directly and shall not respond substantively without instructions unless legally required.

7.3. Instructions. The Licensee is responsible for providing clear and documented instructions to the Supplier regarding the processing of Personal Data.

8. DATA TRANSFERS

8.1. Data Transfers to Third Countries. Transfers outside the EEA. Personal Data may be transferred outside the EEA, including through remote access or onward transfers constituting a transfer, only on documented instructions and in compliance with Chapter V GDPR. Before transfer, the applicable mechanism, such as a relevant adequacy decision or the appropriate EU Standard Contractual Clauses (SCCs), must be identified and implemented, together with any required transfer assessment and supplementary measures. Reference to the SCCs in this Agreement does not itself execute them or complete their annexes. The Supplier shall provide relevant information and evidence of safeguards on reasonable request, subject to appropriate protection of confidential information. Separately agreed location and notification requirements remain applicable.

9. TERM AND TERMINATION

9.1. Term. This Agreement shall remain in effect for the duration of the Main Agreement and for as long as the Supplier holds or processes Personal Data on behalf of the Licensee.

9.2. Termination for Breach. Either Party may terminate this Agreement with immediate effect if the other Party is in material breach of any obligation under this Agreement and fails to remedy such breach within thirty (30) days of written notice.

9.3. Consequences of Termination. Upon termination of this Agreement, the Supplier shall cease processing any Personal Data on behalf of the Licensee and comply with the deletion and return obligations specified in Clause 5.8. Processing strictly necessary for lawful retention, return or secure deletion may continue under this Agreement. No contractual cure period permits processing contrary to Applicable Law.

10. MISCELLANEOUS

10.1. Entire Agreement. This Agreement, together with the Main Agreement, constitutes the entire understanding between the Parties with respect to the processing of Personal Data. In the event of a conflict regarding data protection, this Agreement prevails over the Main Agreement, subject to the expressly agreed exceptions permitted by Clause 10.4 and the precedence of applicable Standard Contractual Clauses.

10.2. Liability. Each Party’s liability arising out of or in connection with this Agreement, including the Supplier’s liability for its Sub-Processors, is subject to the applicable limitations and exclusions of liability in the Main Agreement. Liability under this Agreement counts towards, and does not increase, the applicable aggregate liability cap under the Main Agreement. Nothing in this Clause limits Data Subjects’ statutory rights, supervisory authorities’ powers, liability that cannot lawfully be limited or excluded, or any liability under applicable Standard Contractual Clauses to the extent that those Clauses prohibit such limitation.

10.3. Governing Law and Jurisdiction. This Agreement, including any non-contractual obligations arising out of it, shall be governed by and construed in accordance with the laws of the Republic of Cyprus. The Parties irrevocably submit to the exclusive jurisdiction of the competent courts of the Republic of Cyprus to resolve any dispute, claim, or proceeding arising in connection with this Agreement. This Clause is without prejudice to mandatory statutory jurisdiction rules and applicable Standard Contractual Clauses.

10.4. Amendments. The Supplier may amend this Agreement by publishing a revised version on its website and notifying the Licensee in writing through the notice mechanism specified in the Main Agreement at least thirty (30) calendar days before the proposed effective date. The notice shall identify the amendments, provide a link to the revised version and specify its effective date. Subject to this Clause, the revised version shall replace the previously applicable version on that date without requiring a separately signed amendment.

If the Licensee does not accept an amendment, it may terminate this Agreement and the Main Agreement without an early termination penalty by giving written notice to the Supplier before the amendment’s effective date. Termination shall take effect on that date, and the previous version of this Agreement shall continue to apply until then. Termination shall not affect rights or obligations accrued before termination, including payment of fees for Services already provided. The provisions governing the return, deletion and protection of Personal Data shall continue to apply for as long as the Supplier retains such data.

Any provision of the Main Agreement expressly excluding or modifying an identified provision of this Agreement shall prevail over that provision and shall remain effective notwithstanding subsequent updates to this Agreement, unless otherwise expressly agreed by the Parties in writing. No such exclusion or modification shall derogate from mandatory requirements of Applicable Law or applicable Standard Contractual Clauses.

10.5. Severability. If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be severed, and the remaining provisions of this Agreement shall remain in full force and effect.

10.6. Acceptance and Electronic Execution. This Agreement may be accepted through any of the methods specified in its opening paragraph, including access to or use of the Software or Services. No separate signature of this Agreement is required where it is accepted through those methods. This Agreement may also be executed separately in counterparts, including by electronic signature. Subsequent amendments shall be governed by Clause 10.4.