Data Processing Addendum (DPA)

The following verified supplementary provisions (v1.0-RC1, 8 November 2026) prevail over the general provisions further down in this document in case of conflict.

2. DATA PROCESSING ADDENDUM — UPDATED ANNEXES

2.1 Roles

Govexa may be a controller for its own account, sales, support, security and web operations. For personal data that a business Customer uploads to the Govexa platform or provides to Govexa for processing through connectors, Govexa generally acts as processor or subprocessor on Customer's documented instructions.

2.2 Categories of data processed — Annex A

Depending on use, Customer Personal Data may include:

Identity and user directory

• first name, last name;
• corporate e-mail;
• user/account identifier;
• organisation, department and role;
• administrator/privileged role information;
• MFA enablement/status information;
• last sign-in or account activity information.

GRC data

• process, asset, data, risk, control and obligation records;
• audit, finding, action and evidence data;
• supplier/third-party records;
• technical vulnerability and security findings;
• files and descriptions uploaded by Customer.

Connector data

Depending on the integration Customer enables, from AWS, Google, Okta, Microsoft Entra, GitHub, Jira, Slack or other supported systems:

• user directory and access information;
• MFA/identity security status;
• last sign-in/activity;
• administrator and privileged roles;
• cloud configuration and security metadata;
• repository configuration and security settings;
• other configuration metadata the integration needs to produce GRC evidence.

Govexa accesses data only within the scope of the integration and instructions Customer enables.

2.3 Govexa-managed AI subprocessors

When Govexa-managed AI is used, Anthropic may be the default AI subprocessor. OpenAI may be an optional AI subprocessor when Govexa enables it for the relevant tenant/plan.

The prompt and contextual Customer Data needed to perform the AI function may be transferred to the relevant provider. International transfer mechanisms for the provider are managed according to applicable law.

Anthropic ZDR is not promised by Govexa as a contractual feature unless separately enabled and verified for Govexa's relevant account.

2.4 Customer-Directed AI — not a subprocessor

If Customer requests in writing to use its own Anthropic/OpenAI account, its own API key or its self-hosted Ollama/model server for the AI functions on the Platform, that provider or system is considered a third party selected/directed by Customer or Customer's own supplier, not a subprocessor selected by Govexa.

In this configuration:

• data sent to the AI function is transmitted on Customer's instruction directly to the provider/endpoint Customer selected;
• the contract, DPA, transfer safeguards and international transfer mechanism with the provider, and any notice required to data subjects, are Customer's responsibility;
• Govexa stores supported connection secrets such as API keys encrypted and does not display them again in the interface;
• when a Customer-Directed AI connection fails, Govexa does not silently fall back to its own AI account.

Technical routing performed by Govexa does not transfer to Govexa the independent legal role of the provider Customer selected directly.

2.5 Sentry

Sentry is considered a subprocessor used for error monitoring only when the DSN/integration is enabled in the relevant production environment. The current application configuration includes sendDefaultPii: false and beforeSend scrubbing controls.

If Sentry is not enabled in production, it is shown as "conditional / only when enabled" in the public subprocessor list or removed from the list of active subprocessors.

2.6 Retention and deletion

As long as Govexa does not yet apply an automatic fixed retention/deletion job for all data classes, the DPA or Privacy Policy gives no commitment to an automatic period, such as "12 months", that is not technically applied.

Retention is determined by data class, contract, security need, legal obligation and the technical backup cycle.

audit_log is currently kept append-only. No specific automatic deletion period is promised for these records until a separately designed and verified retention mechanism for their deletion/anonymisation is in place.

2.7 Backup and business continuity

Backup features offered by the provider may be used in Govexa's database infrastructure. However, Govexa does not offer a tested restore procedure or written RPO/RTO targets as a contractual guarantee until they are technically established and evidenced.

2.8 International transfers

For Restricted Transfers under the GDPR, European Commission SCCs and the necessary supplementary measures are used where appropriate.

For cross-border transfers under the KVKK, the appropriate mechanism under Article 9 of Law No. 6698 and the secondary legislation in force is used. Where the KVKK standard contract is used, the applicable notification obligations are fulfilled.

General provisions

4.1 Scope and precedence

This DPA forms part of the agreement between Customer and Govexa where Govexa processes personal data on Customer's behalf in providing the Services. If this DPA conflicts with the Terms regarding processing of Customer Personal Data, this DPA prevails.

4.2 Roles

Customer is controller (or processor acting for another controller) and Govexa is processor (or subprocessor, as applicable) for Customer Personal Data.

Each party will comply with applicable data-protection law, including GDPR and/or KVKK where applicable.

4.3 Processing instructions

Govexa will process Customer Personal Data only on Customer's documented instructions, including as necessary to provide, secure, support and maintain the Services, unless law requires otherwise. Govexa will inform Customer of a legally required processing instruction where permitted.

4.4 Confidentiality

Persons authorised to process Customer Personal Data will be subject to confidentiality obligations.

4.5 Security

Govexa will implement appropriate technical and organisational measures taking account of the state of the art, costs, nature, scope, context and purposes of processing and risks to individuals.

Measures may include access control, least privilege, encryption in transit, appropriate encryption at rest, logging, backup, vulnerability management, incident response, secure development and provider due diligence.

4.6 Subprocessors

Customer provides general authorisation for Govexa to engage subprocessors necessary to provide the Services. Govexa will impose appropriate data-protection obligations on subprocessors where required and remain responsible for its own obligations under this DPA.

Govexa will maintain a current subprocessor list. For enterprise Customers requiring change notification or objection rights, the applicable Order Form or enterprise terms may specify the notification procedure and objection period.

4.7 AI subprocessors and BYOAI

Anthropic may be used by default for Govexa-managed AI functions and OpenAI may be used when selected/configured.

Where Customer chooses BYOAI and contracts directly with that provider, the provider may be treated as a Customer-directed third party rather than a Govexa-selected subprocessor to the extent Govexa merely routes Customer instructions and data to that service. Customer is responsible for its contractual and data-protection relationship with that provider.

4.8 Data-subject requests

Taking into account the nature of processing, Govexa will reasonably assist Customer with data-subject requests where required and where Customer cannot fulfil the request without Govexa's assistance.

4.9 Security incidents

Govexa will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data, provide information reasonably available to it and cooperate with Customer's lawful response obligations. Notification does not constitute admission of fault.

4.10 DPIA and regulatory assistance

Taking into account the nature of processing and information available, Govexa will provide reasonable assistance with DPIAs, prior consultation and regulator requests where required by applicable law. Extraordinary assistance may be subject to reasonable fees where legally permissible and agreed.

4.11 Deletion and return

Upon termination and Customer's request, Govexa will delete or return Customer Personal Data within a reasonable period, unless retention is required by law. Residual backup copies may remain until overwritten under normal backup cycles and will remain protected.

4.12 Audits

Govexa will make available information reasonably necessary to demonstrate compliance. Where appropriate, independent certifications, audit reports, security documentation and questionnaires may satisfy audit requirements. On-site audits will be subject to reasonable notice, confidentiality, security and non-disruption requirements.

4.13 International transfers — GDPR

Where Govexa's processing involves a Restricted Transfer under GDPR, the parties agree that the applicable European Commission SCC module will be incorporated as necessary:

• Module Two for Controller-to-Processor transfers;
• Module Three where Customer is a Processor and Govexa a Subprocessor.

The parties' agreement, this DPA, the Processing Details and security measures provide the information necessary to complete the SCC annexes. Where required, Govexa will implement supplementary measures based on transfer risk.

4.14 International transfers — KVKK

For transfers subject to KVKK, the parties will use the transfer mechanism legally available and appropriate at the relevant time, including an adequacy decision, appropriate safeguard, standard contract or other lawful mechanism. Each party will fulfil applicable filing/notification obligations allocated to it by law.

4.15 Processing details

Subject matter: provision of the Govexa SaaS platform.
Duration: subscription term plus permitted retention/deletion period.
Nature: collection, storage, organisation, retrieval, transmission, analysis, AI inference, reporting, security monitoring, support, deletion and other operations necessary to provide the Services.
Purpose: providing GRC, risk, compliance, audit, workflow, evidence, reporting and AI-assisted functionality.
Data subjects: Customer personnel, authorised users, suppliers, contacts, audit subjects and other individuals whose data Customer lawfully submits.
Data types: identity/contact data, organisational data, account data, compliance/risk/audit records, evidence, technical metadata, prompts and other Customer-selected content.
Sensitive data: not required by default; if Customer submits sensitive/special-category data, Customer is responsible for ensuring a lawful basis and appropriate safeguards.

• — — — — — — — — — — — — — — — — — — — — — — — --