SELISE GEO Data Processing Addendum

1. Scope of Application

1.1 In the course of providing SELISE GEO under the SELISE GEO Terms of Use, the applicable subscription and any customer-specific offer incorporating them (together, the “SELISE GEO Terms”), SELISE Group AG, The Circle 37, 8058 Zürich-Flughafen, Switzerland (“SELISE”), as Processor processes personal data provided by the customer (the “Customer”) in order to render the services and for which the Customer acts as controller under data protection law (the “Customer Data”). The Customer remains the Controller under data protection law.

1.2 This Addendum (“DPA”) specifies the data protection obligations and rights of the Parties in connection with the processing of Customer Data for the provision and operation of SELISE GEO. The subject matter, nature and purpose of the processing and the categories of data subjects and personal data are described in Annex 3 (Description of Processing).

1.3 This DPA forms an integral part of the SELISE GEO Terms. The Customer accepts it electronically by ticking the acceptance box when signing up for or subscribing to SELISE GEO, and no separate signature is required.

1.4 Where SELISE processes personal data for its own purposes as an independent controller, such as account, billing, security and communications data, this processing is not covered by this DPA and is governed by the SELISE GEO Privacy Policy.

1.5 Where the Customer processes Customer Data on behalf of another controller, SELISE acts as sub-processor, and the Customer confirms that it is authorised to engage SELISE in that role.

2. Applicable Data Protection Law

2.1 SELISE is headquartered in Switzerland and generally adheres to the Swiss Federal Act on Data Protection (“FADP”) and guarantees compliance with it. If the Controller is located in the EU or if the General Data Protection Regulation (“GDPR”) applies to the Controller's processing activities (Article 3(2) GDPR), SELISE also undertakes to comply with the GDPR.

3. Scope of the Commissioning / Controller Instructions

3.1 SELISE shall process Customer Data exclusively on behalf of and in accordance with the documented instructions of the Controller within the meaning of Article 28 GDPR and Article 9 FADP, unless SELISE is legally required to carry out additional processing. In that case, SELISE shall inform the Controller of the legal requirement before the processing, unless the law prohibits this on important grounds of public interest. If SELISE considers that an instruction infringes data protection law, it shall inform the Controller and may suspend the relevant processing until the matter is resolved.

3.2 The processing comprises exclusively the type, scope and purpose determined by the Controller and described in the SELISE GEO Terms and Annex 3. The duration of the processing corresponds to the term of the applicable SELISE GEO subscription and the return and deletion period set out in Section 9.

3.3 SELISE may anonymise or aggregate Customer Data so that individual data subjects can no longer be identified, and may use such data to design, develop, optimise and provide SELISE GEO. Anonymised or aggregated data is not personal data for the purposes of this DPA.

3.4 Processing shall in principle take place in Switzerland, the European Union or the European Economic Area (EEA). SELISE GEO is hosted on Microsoft Azure in Switzerland (Switzerland North region). SELISE may also process Customer Data within the SELISE group, including through [SELISE Bangladesh Limited] for development, operations and support, and through the sub-processors listed in Annex 1, including in countries outside Switzerland, the EU and the EEA. In that case, SELISE ensures that the requirements for international transfers under the FADP and the GDPR are met, in particular through the Standard Contractual Clauses of the European Commission, including those incorporated in the SELISE intra-group data transfer agreement.

3.5 Where Customer Data is transferred to a third country, SELISE shall apply appropriate technical and organisational measures in addition to the transfer mechanism, as described in Annex 2. If SELISE receives a legally binding request from an authority or court to disclose Customer Data, it shall inform the Controller before disclosure unless prohibited by law, and shall disclose only the Customer Data it is legally required to disclose.

3.6 SELISE GEO uses third-party AI providers to run audits and AI-assisted functions. The information needed for the requested function, such as brand, competitor, persona and query information, may be sent to these AI providers, which are identified in Annex 1. SELISE does not use Customer Data to train its own AI models without the Customer's written consent. The use and retention of inputs and outputs by AI providers is governed by the AI providers' own terms.

4. Personnel Requirements

4.1 SELISE warrants that all persons involved in processing Customer Data, including employees and consultants, are prohibited from processing it outside the scope of their instructions and have committed to confidentiality or are subject to an appropriate statutory obligation of secrecy. These obligations survive the end of their engagement.

5. Security of Processing

5.1 SELISE shall implement appropriate technical and organisational measures, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of data subjects, to ensure a level of security appropriate to the risk.

5.2 Before processing Customer Data, SELISE shall implement the measures described in Annex 2 (SELISE GEO Technical and Organisational Measures, the “TOMs”).

5.3 SELISE may update the measures from time to time, provided that the overall level of protection is not materially reduced.

6. Engagement of Sub-processors

6.1 The Controller authorises SELISE to engage sub-processors in a general manner. The sub-processors currently engaged for SELISE GEO are listed in Annex 1.

6.2 SELISE shall inform the Controller of any intended addition or replacement of a sub-processor. The Controller may object within thirty (30) days for important data protection reasons. If the Controller does not object within that period, the change is deemed accepted. If the Parties cannot find an amicable solution to a justified objection, either Party may terminate the affected subscription. SELISE shall update Annex 1 accordingly.

6.3 SELISE shall impose on each sub-processor data protection obligations that provide a level of protection equivalent to this DPA and, where the GDPR applies, the obligations required by Article 28(3) GDPR. SELISE remains responsible for its sub-processors to the extent required by law.

7. Data Subjects' Rights

7.1 If a data subject contacts SELISE directly with a request for access, rectification or erasure and SELISE can link the request to the Controller, SELISE shall refer the data subject to the Controller and forward the request to the Controller without undue delay.

7.2 SELISE shall, to a reasonable extent, support the Controller with appropriate technical and organisational measures in responding to data subject requests. SELISE is not liable if the Controller fails to respond to a request in full, correctly or on time.

8. Other Support Obligations of SELISE

8.1 SELISE shall notify the Controller without undue delay after becoming aware of a breach of security affecting Customer Data and shall, on request, assist the Controller in meeting its notification obligations under Article 24 FADP or Articles 33 and 34 GDPR. Where possible, the notification shall describe:

(a) the nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned;

(b) the likely consequences of the breach; and

(c) the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

Where not all information is available at the time of notification, SELISE may provide it in phases.

8.2 SELISE shall assist the Controller with data protection impact assessments and any related consultation with the supervisory authority to the extent reasonable and necessary. The Controller shall reimburse SELISE's reasonable costs for such assistance, unless otherwise agreed.

9. Deletion and Return of Customer Data

9.1 After the SELISE GEO subscription ends, SELISE shall keep the Customer Data available for [twelve (12) months] so that the Customer can access and export it, unless the Customer instructs SELISE to delete it earlier. SELISE shall then delete or return the Customer Data, unless the law requires SELISE to retain it.

9.2 Copies held in backup systems are deleted in SELISE's ordinary backup cycle. Until then, they remain protected under this DPA and are not used for any other purpose.

10. Evidence and Audits

10.1 SELISE shall provide the Controller, on request, with all information reasonably required and available to demonstrate compliance with this DPA.

10.2 The Controller may audit SELISE's compliance with this DPA, including the technical and organisational measures, including by inspection, subject to the conditions below.

10.3 Inspections take place at SELISE's business premises where Customer Data is processed, during usual business hours (Monday to Friday, 08:00 to 17:00), after advance notice under Section 10.5, at the Controller's own expense, without disrupting business operations and subject to strict confidentiality of SELISE's business and trade secrets.

10.4 SELISE may withhold information that is commercially sensitive or whose disclosure would breach legal or contractual obligations. The Controller has no right of access to data of other SELISE customers, cost information or other confidential information not directly relevant to the audit.

10.5 The Controller shall notify SELISE of an audit in good time, usually at least two weeks in advance. The Controller may conduct one audit per calendar year. Further audits are subject to reimbursement of SELISE's reasonable costs and prior consultation with SELISE, unless mandatory law requires otherwise.

10.6 If the Controller engages a third party to conduct an audit, it shall bind the third party in writing to the obligations in this Section 10 and to confidentiality, unless the third party is subject to professional secrecy. The Controller may not appoint a competitor of SELISE as auditor.

10.7 At SELISE's discretion, compliance may be demonstrated instead of an inspection by a current opinion, report or certification from an independent body, provided that it allows the Controller to reasonably assess compliance.

11. Contract Term and Termination

11.1 The term and termination of this DPA are governed by the SELISE GEO Terms and the applicable subscription. Termination or expiry of the subscription ends this DPA for that processing, except for obligations that by their nature continue, such as return and deletion, confidentiality and audit obligations. This DPA cannot be terminated separately unless required by law.

12. Liability

12.1 The Parties' liability under this DPA is governed by the limitations and exclusions of liability in the SELISE GEO Terms. SELISE is liable under this DPA only for a material breach of its obligations.

12.2 The Controller shall indemnify SELISE, upon first request and to the extent legally permissible, against fines imposed on SELISE to the extent they correspond to the Controller's share of responsibility for the infringement.

13. Final Provisions

13.1 If any provision of this DPA is or becomes invalid or contains a gap, the remaining provisions remain unaffected. The Parties shall replace the invalid provision with a valid provision that comes closest to its purpose and meets the applicable data protection requirements.

13.2 Where the GDPR applies to the processing, the Parties acknowledge that the GDPR governs data protection matters notwithstanding any choice-of-law clause.

13.3 In the event of a conflict between this DPA and the SELISE GEO Terms, this DPA prevails with respect to the processing of Customer Data, to the extent of the conflict.

13.4 This DPA is executed in English. If a translation is prepared, the English version prevails.

13.5 This DPA is governed by Swiss law. The Parties shall first try to resolve any dispute amicably through good-faith negotiations and, failing that, by mediation, in accordance with the SELISE GEO Terms.

ANNEX 1 - SUB-PROCESSOR LIST

SELISE engages the following sub-processors to process Customer Data for SELISE GEO.

ANNEX 2 - TECHNICAL AND ORGANISATIONAL MEASURES (TOMs)

SELISE maintains technical and organisational measures designed to protect Customer Data processed through SELISE GEO against unauthorised access, loss, alteration, disclosure or destruction, taking into account the nature of the processing and the risks involved. SELISE GEO is hosted on Microsoft Azure in Switzerland, and its application services are built on SELISE Blocks, operated by SELISE Group AG. The measures below follow the Confidentiality, Integrity and Availability (CIA) structure.

ANNEX 3 - DESCRIPTION OF PROCESSING