Data Processing Addendum

Personal Data means information relating to an identified or identifiable individual contained in Customer Data that Fynbase processes on Customer's behalf. Data Protection Laws means privacy and data-protection laws applicable to that processing, including applicable US state laws and, where applicable, the EU GDPR, UK GDPR, and Swiss data-protection law. Processing, controller, processor, service provider, and business have the meanings given under the applicable law. Subprocessor means another entity engaged by Fynbase to process Personal Data on Customer's behalf.

Customer is the controller or business, or a processor acting with authority from its controller. Fynbase is a processor, subprocessor, or service provider, as applicable. Customer remains responsible for the lawfulness of its instructions, necessary notices and permissions, data accuracy, and the authority to provide Personal Data. Fynbase is responsible for its obligations as a processor or service provider.

Information Fynbase independently needs to administer its customer relationship, bill for its own Services, or meet its own legal obligations is addressed by the Privacy Policy to the extent Fynbase lawfully acts as a controller. That distinction does not authorize reuse of customer documents or content for unrelated purposes.

Fynbase will process Personal Data only to provide, support, secure, and maintain the Services on Customer's documented instructions, as set out in the Agreement, this DPA, Customer's authorized settings and workflows, and other mutually accepted written instructions. Appendix A describes the processing. Customer may issue additional lawful instructions by contacting support@info.fynbase.co. The parties will address any resulting changes to scope or fees in writing without limiting duties imposed by law.

If law requires other processing, Fynbase will inform Customer beforehand unless prohibited by law. Fynbase will promptly inform Customer if it believes an instruction violates Data Protection Laws and may suspend the affected processing while the parties resolve the issue. Fynbase will not sell Personal Data, share it for cross-context behavioral advertising, or use it for unrelated marketing.

Fynbase will limit access to authorized personnel who need it for their duties and are subject to confidentiality obligations that survive the end of their engagement. It will provide appropriate privacy and security instruction.

Fynbase will not use customer confidential information or business, financial, or operational data to train generalized AI models for unrelated customers or third parties without Customer's express consent. It will impose the same restriction on AI subprocessors. Ordinary AI inference, product use, or acceptance of the Agreement does not constitute training consent. Aggregation or de-identification will not be used to avoid this restriction. Any permitted de-identification must satisfy applicable law and include measures against re-identification.

Fynbase will maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and access, taking account of the risks, nature of the data, and processing. Appendix B describes the minimum contractual safeguards. Fynbase may update measures without materially reducing the overall protection during the Agreement. Customer is responsible for its own devices, access permissions, integration authority, and lawful workflow configuration.

Customer provides general written authorization for Fynbase to engage subprocessors under this section. Before a subprocessor first processes Customer Personal Data, Fynbase will disclose its legal name, function, processing locations, and affected data categories in the schedule described in Appendix C. The customer-specific schedule supplied with onboarding or an Order Form is incorporated into Appendix C. A service category alone does not identify or authorize an unnamed provider.

Fynbase will conduct proportionate diligence, enter a written agreement imposing data-protection obligations no less protective for the relevant processing, and remain responsible for the subprocessor's performance of those obligations. This includes confidentiality, security, deletion, incident cooperation, and the AI restriction where applicable.

Fynbase will give Customer at least 30 days' advance notice by account email before adding or replacing a subprocessor. Customer may object within that period on reasonable data-protection grounds by contacting support@info.fynbase.co. The parties will work in good faith on an alternative, configuration change, or other reasonable resolution. Fynbase will not send Customer's affected Personal Data to the disputed subprocessor while a timely objection is unresolved. If no resolution is available, either party may terminate the affected portion of the Services before that processing begins. Fees remain subject to the Agreement's non-refund terms except where law or an applicable written agreement requires otherwise.

A Personal Data Breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. Unsuccessful attacks without compromise are not by themselves Personal Data Breaches.

Fynbase will notify Customer without undue delay after becoming aware of a Personal Data Breach. An initial notice need not await completion of an investigation. Fynbase will provide available information about the nature of the breach, affected data and individuals, likely consequences, mitigation and remediation, and a contact for further information, and provide updates as information becomes available.

Fynbase will take reasonable steps to contain, investigate, and remediate the breach, preserve relevant evidence, and assist Customer with legally required notifications. Notice is not an admission of fault. Customer determines its notifications to regulators and individuals, unless law requires Fynbase to act directly. Fynbase will coordinate with Customer where lawful and will not identify Customer publicly without authorization unless legally required.

Taking account of the processing and information available to it, Fynbase will provide appropriate technical and organizational assistance with requests for access, correction, deletion, restriction, objection, and portability, and other rights under applicable law. Fynbase will promptly notify Customer of requests relating to Customer-controlled data and will not substantively respond except on Customer's instructions or as legally required.

Fynbase will reasonably assist Customer with security duties, data-protection impact assessments, prior consultations with authorities, and other required assessments. Assistance will be timely enough to allow compliance with applicable deadlines. Any agreed fees for extraordinary assistance will not prevent or condition assistance required by law, and Fynbase will not charge Customer to remedy Fynbase's own breach of this DPA.

Fynbase will make available information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or an independent auditor bound by confidentiality. The parties will first use relevant documentation or independent reports, if available, where sufficient. This does not imply that an independent certification or audit report exists.

Routine audits require reasonable advance notice, normal business hours, and measures to protect other customers' data and service security. Normally one routine audit per year is sufficient; additional audits may occur where required by law or a regulator, after a material breach, or on reasonable evidence of noncompliance. Fynbase will not use procedural conditions to frustrate legally required audit rights. Each party bears its own routine costs unless otherwise agreed; Fynbase bears its reasonable remediation costs for its noncompliance.

Customer may request return or deletion of Personal Data at the end of the Services. Customer has 30 calendar days after expiration or the effective date of cancellation or termination to request or complete an available export. Fynbase will reasonably assist with a secure, commonly used export format and preserve data subject to a timely request while completing it. Security restrictions may require verified delivery rather than restored account access.

Unless Customer requests earlier lawful deletion, Fynbase will delete or irreversibly de-identify remaining Personal Data in active systems within 30 days after the export period ends. Fynbase will cause residual backup copies to expire within 90 days after active-system deletion, isolate them from ordinary use, and reapply deletions following a recovery. De-identification must meet applicable law; at Customer's election where required by law, Fynbase will delete rather than de-identify the data.

If law requires retention, Fynbase will retain only what is required, protect and restrict its use to that purpose, and delete it when the requirement ends. Fynbase will provide deletion confirmation on request, identifying any lawful retention or pending backup expiration. This DPA continues to govern all retained Personal Data.

Fynbase will disclose applicable processing locations through Appendix C and will not make a transfer requiring a legal transfer mechanism until that mechanism is in place. Where needed, the parties will execute the appropriate EU Standard Contractual Clauses and completed annexes, the UK International Data Transfer Addendum or other valid UK mechanism, or applicable Swiss protections, and implement required supplementary measures and assessments.

This DPA does not itself execute or complete those transfer instruments and does not represent that Fynbase is certified under any adequacy or data privacy framework. Customer must notify Fynbase before initiating processing requiring a transfer mechanism that has not already been agreed. The affected processing must not begin until the necessary safeguards are established. Mandatory transfer provisions control any inconsistent Agreement term, including governing law, jurisdiction, or liability restrictions.

Where Fynbase acts as a service provider or contractor under the California Consumer Privacy Act, Customer discloses Personal Data only for the limited and specified business purposes in Appendix A. Fynbase will comply with applicable CCPA obligations and provide the same level of privacy protection required by the CCPA.

Fynbase will not sell or share Personal Data; retain, use, or disclose it outside the specified purposes or outside the direct business relationship; or combine it with personal information received from other persons or collected from its own interactions with individuals, except to the extent expressly permitted by applicable law. Fynbase certifies that it understands and will comply with these restrictions.

Customer may take reasonable and appropriate steps to ensure consistent use of Personal Data, and to stop and remediate unauthorized use. Fynbase will notify Customer if it determines it can no longer meet its obligations. Corresponding processor restrictions and assistance duties apply under other applicable US state privacy laws. The parties will cooperate to determine roles where the facts or law require a different allocation.

This DPA controls conflicts concerning processing of Personal Data, except that mandatory law and applicable executed transfer instruments prevail. The Agreement's California governing law, dispute process, and liability provisions otherwise apply, without restricting nonwaivable individual or regulatory rights. Changes to this DPA will not materially reduce protection of Personal Data during the agreed subscription term without Customer's agreement.

Fynbase | 1601 McCarthy Blvd, Suite R-5, Milpitas, CA 95035, United States | support@info.fynbase.co

Subject matter and purpose: Delivery, support, security, and maintenance of Fynbase business software for accounts receivable and payable, invoices, bills, procurement, approvals, documents, communications, reconciliation, integrations, AI-assisted tasks, and customer-authorized automation.

Nature of processing: Receiving, collecting at Customer's direction, organizing, storing, retrieving, analyzing, extracting, generating outputs, transmitting to authorized recipients and providers, exporting, and deleting data. Processing is continuous or as instructed while features are enabled.

Duration: The subscription or other service period, the 30-day export period, the deletion periods in Section 9, and any legally required retention.

Individuals: Customer's employees, contractors, authorized users, customers, prospects, suppliers, vendors, invoice recipients, and other business contacts whose information Customer supplies.

Data types: Business contact and identification details, roles and permissions, invoices and accounting entries, purchase records, amounts and payment status, correspondence and attachments, integration identifiers and tokens, relevant logs, and AI inputs and outputs. Financial or tax identifiers may be included where needed for supported workflows.

Sensitive data limits: Customer must minimize sensitive data and not submit special-category data, criminal-offense data, children's data, complete payment-card credentials, or unrelated identity documents unless separately agreed in writing with appropriate safeguards. Financial records and authentication tokens must receive restricted access and encryption appropriate to their risks.

Customer instructions and contacts: The account administrator and contacts identified in the account or Order Form may provide instructions within their authority. Customer will maintain an accurate security and privacy contact. Fynbase's contact is support@info.fynbase.co at the address above.

Governance and personnel: A documented security program, assigned responsibility, periodic risk review, confidentiality obligations, and training appropriate to access.

Access control: Named accounts, least-privilege permissions, authorization before production access, MFA for privileged and remote administrative access, periodic access review, and prompt removal when access is no longer required.

Data protection: Encryption for Personal Data in transit over public networks and at rest in production databases and backups, controlled key and secret access, and logical separation of customer environments or data.

Secure operations: Managed endpoint protection, security patches and vulnerability remediation based on risk, review of production changes, protected logs of relevant administrative and security events, and incident investigation procedures.

Resilience: Regular backups appropriate to recovery needs, restricted backup access, periodic restore testing, and documented recovery procedures. These measures do not establish a contractual uptime or recovery-time guarantee.

Data lifecycle: Data minimization, authorized and logged support access, restrictions on production data in testing, defined retention, secure deletion, and protections for data retained in backups or under legal holds.

Supplier oversight: Review before access, written processing and security duties, records of processing locations, and oversight of relevant supplier changes.

The subprocessor schedule applicable to Customer is the dated provider register supplied by Fynbase with Customer's onboarding or Order Form, as updated under Section 5. Fynbase will provide a current copy on request at support@info.fynbase.co before any proposed provider processes Customer Personal Data. No provider is authorized solely because it belongs to a category below. If no named schedule has been supplied, no subprocessor is authorized to process Customer Personal Data under this DPA until it is supplied and the applicable authorization procedure is completed.

Each provider entry must state the provider's full legal name; service and purpose; Personal Data categories; hosting and remote-access countries; relevant transfer safeguards; and date added or last changed. Providers performing multiple functions must disclose each relevant function. Material location changes follow Section 5's notice and objection process.

The schedule covers providers used for infrastructure and storage; database and authentication; AI inference and document processing; communications; monitoring and security; and customer support, to the extent they process Customer Personal Data. Customer-selected integrations acting on Customer's own behalf are not automatically Fynbase subprocessors; their roles depend on the actual processing arrangement. Payment providers acting independently for Fynbase subscription billing are disclosed under the Privacy Policy rather than automatically classified as subprocessors.