DATA PROCESSING ADDENDUM (DPA)

28 August 2026

This Data Processing Addendum forms an integral part of the principal service agreement or Terms of Use concluded between VÖEN 1202614302, which represents the AISALESPOS platform, and the customer.

1. Roles of the parties

Within the framework of this Addendum:

The Customer acts as the controller of the personal data
The Company acts as the processor which processes that data for the purpose of providing the service

If in certain cases the roles of the parties differ, the actual role applies in respect of that part.

2. Subject matter and purpose of processing

The Company may process personal data for the following purposes:

to create and manage accounts
to process orders, sales and POS transactions
to store inventory and business data
to provide support and technical services
to carry out security and audit activities
to perform backup and restoration
to operate integrations
to comply with legal obligations

3. Categories of personal data

The data processed may include the following:

first name, last name
telephone
e-mail
address
customer order data
sales history
user roles and login logs
business transaction records
device and IP data

4. Data subjects

Data relating to the following persons may be processed:

the customer's end users
the customer's employees
cashiers and managers
branch and store staff
delivery and related persons
end purchasers

5. Obligations of the processor

The Company undertakes:

to process the data only in accordance with the controller's documented instructions
to protect the confidentiality of the data
to take appropriate security measures
to engage a sub-processor only where necessary
to support the controller, where possible, in relation to legal enquiries and data subject requests
to return, delete or anonymise the data upon termination of the service
as set out above.

6. Obligations of the controller

The Customer is responsible for:

the lawful collection of personal data
the provision of notice to data subjects
obtaining consent where consent is required
the accuracy of the data
the provision of lawful instructions for processing
as set out above.

7. Security

The Company takes reasonable technical and organisational measures. Such measures may include the following:

access restrictions
authentication
logging
encryption or appropriate security mechanisms
backup copies
monitoring
role-based access control

8. Sub-processors

The Company may use sub-processors for hosting, e-mail, SMS, analytics, support, monitoring and other necessary services. The Customer accepts this. Where possible, the Company endeavours to apply appropriate contractual obligations with such parties.

9. International transfers

Personal data may be processed through infrastructure and service providers located in various countries. The Customer accepts this. Where necessary, appropriate contractual and protective mechanisms are applied.

10. Data subject requests

If a data subject makes a request concerning access, erasure, rectification or other rights, the Company may, where possible, refer it to the controller or provide support in accordance with the controller's instructions.

11. Data breaches

Where the Company detects a personal data breach, it will endeavour to inform the controller to the extent required by the applicable legislation.

12. Audit and evidence

Where there is a substantiated security or legal necessity, the parties may share compliance evidence, policies or contractual confirmations within a reasonable framework. This process must not put at risk the Company's confidential information, its other customers or its security model.

13. Term and effect

This DPA applies for as long as the principal agreement remains in force, and the parts relating to the processing of personal data may, where necessary, remain in force after the agreement ends.

14. Conflict

If a conflict arises between this Addendum and the principal agreement regarding the processing of personal data, this Addendum prevails in respect of that part.