Last Updated: October 6th, 2026

This Data Protection Addendum (“DPA”) applies between the Customer and the Trustmary Group entity that is a party to the agreement with the Customer (“Trustmary Contracting Entity”), to the extent that the Trustmary Contracting Entity processes personal data on behalf of the Customer in connection with the Customer’s use of the Trustmary online platform (“Service”) in accordance with the Trustmary Terms of Service (“Agreement”).

The Customer shall be considered the data controller of such personal data under EU regulation 2016/679 (“GDPR”) and the Trustmary Contracting Entity will process, when providing the Service to the Customer, such personal data on behalf of the Customer as a data processor. As used herein, “personal data” means personal data processed by the Trustmary Contracting Entity, directly or through its subprocessors, on behalf of the Customer for the purposes of the Agreement.

For the avoidance of doubt, this DPA shall not apply to the processing of personal data for which the Trustmary Contracting Entity or another Trustmary Group entity acts as an independent data controller in accordance with the GDPR (e.g. business contact information and invoicing information within the scope of the Parties’ cooperation).

The processing is initially specified as follows:

Nature, purpose and duration of processing: Provision of the Service to Customer during the term of the Agreement including collection of customer feedback, measurement of customer satisfaction, management of recommendations and references, and reporting and analysis for the Customer.

Types of personal data: Names and contact details (including phone number, email address, company and job title), customer reviews, recommendations, survey responses, customer satisfaction data and other feedback given by an identifiable individual, identifiable media content such as video testimonials and photographs, and other information voluntarily provided by the individual.

Categories of data subjects: Customers of the Customer, employees or contractors of the Customer, other stakeholders of the Customer, and other individuals from whom reviews, feedback, recommendations or survey responses are collected.

1. Processing of Personal Data

The Trustmary Contracting Entity shall only process personal data in accordance with this DPA and documented instructions from the Customer, unless required to do so by Union or Member State law to which the Trustmary Contracting Entity is subject. In such case, the Trustmary Contracting Entity shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Customer’s instructions must be commercially reasonable, compliant with applicable data protection legislation and consistent with this DPA. If the Customer’s instructions require additional measures or work to be performed by the Trustmary Contracting Entity, the Trustmary Contracting Entity has the right to charge an hourly consulting fee from the Customer for complying with such Customer’s instructions in accordance with the Trustmary Contracting Entity’s then-current price for consulting services, subject to the Customer’s prior approval of such additional costs.

The Trustmary Contracting Entity shall immediately notify the Customer in writing, if, in its opinion, an instruction of the Customer infringes applicable data protection legislation. In case the instructions of the Customer are not compliant with the GDPR or any other applicable data protection legislation, the Trustmary Contracting Entity is not required to comply with such Customer’s instructions.

2. Data Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Trustmary Contracting Entity’s processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Trustmary Contracting Entity shall implement and maintain appropriate technical and organizational security measures in order to safeguard the personal data against unauthorized or unlawful processing and damage, and in particular against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

Such measures shall include, as appropriate, measures in the following areas:

Access control and authentication. The Trustmary Contracting Entity shall restrict access to personal data to persons who require such access for the performance of their duties. User accounts shall be personal and protected by appropriate authentication mechanisms. Privileged access rights shall be limited to persons whose duties require such access and shall be reviewed periodically. Access rights shall be removed or updated without undue delay when they are no longer required. Multi-factor authentication shall be used for administrative access where technically feasible and appropriate.

Encryption. Personal data shall be protected in transit using appropriate and generally accepted encryption methods. Personal data stored in production environments shall be protected by encryption or other technical measures providing a comparable level of protection where appropriate having regard to the nature and risks of the processing.

Systems and infrastructure security. The Trustmary Contracting Entity shall maintain appropriate safeguards designed to protect the systems and infrastructure used to provide the Service against unauthorized access, malware and other security threats. Security updates and patches shall be applied on a risk-based basis without undue delay. Production environments shall, where appropriate, be separated from development and testing environments.

Backup, availability and recovery. The Trustmary Contracting Entity shall maintain appropriate measures designed to ensure the availability and resilience of systems processing personal data, including appropriate backup and recovery procedures. Backups shall be protected against unauthorized access, alteration and loss, and recovery procedures shall be tested periodically, as appropriate.

Development and change management. Changes to production systems shall be subject to appropriate change management procedures. The Trustmary Contracting Entity shall take reasonable measures to identify and remediate security vulnerabilities in connection with the development and maintenance of the Service. Production personal data shall not be used in testing environments without appropriate safeguards.

Personnel security and confidentiality. Individuals authorized to process personal data shall have committed themselves to confidentiality or be under an appropriate statutory obligation of confidentiality and shall receive appropriate data protection and information security guidance or training relevant to their duties. The Trustmary Contracting Entity shall maintain appropriate internal policies and procedures for the secure processing of personal data.

Security incident management. The Trustmary Contracting Entity shall maintain appropriate procedures for identifying, investigating, managing, documenting and remediating security incidents.

Review and development of security measures. The Trustmary Contracting Entity shall regularly assess the appropriateness and effectiveness of its technical and organizational measures and update them where appropriate. The Trustmary Contracting Entity may modify or update its security measures from time to time, provided that such modifications or updates do not materially decrease the overall level of security provided for personal data.

The Trustmary Contracting Entity shall require subprocessors processing personal data on its behalf to implement appropriate technical and organizational measures designed to provide a level of security consistent with the requirements of this DPA. See Section 4.

Security incident notification. The Trustmary Contracting Entity shall, without undue delay after becoming aware of a personal data breach, notify the Customer in writing. To the extent such information is available to the Trustmary Contracting Entity, the notification shall include at least: (i) a description of the nature of the breach; (ii) the name and contact details of the Trustmary Contracting Entity’s contact point from which further information can be obtained; (iii) a description of the likely consequences of the breach; and (iv) a description of the measures taken or proposed to be taken by the Trustmary Contracting Entity to address the breach, including, where appropriate, measures to mitigate its possible adverse effects. Where it is not possible to provide the information at the same time, the information may be provided in phases. The Trustmary Contracting Entity shall document personal data breaches, including the facts relating to the breach, its effects and the remedial action taken.

3. Assistance Obligations

Taking into account the nature of the processing, the Trustmary Contracting Entity shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s obligation to respond to requests for exercising the data subject’s rights under Chapter III of the GDPR (such as the right of access and the right to rectification or erasure).

Taking into account the nature of the processing and the information available to the Trustmary Contracting Entity, the Trustmary Contracting Entity shall further provide the Customer with assistance in ensuring compliance with the Customer’s obligations set out in Articles 32 to 36 of the GDPR (e.g. security and data protection impact assessments, breach notifications and prior consultations with the competent supervisory authority). Where applicable, the Trustmary Contracting Entity shall also provide reasonable assistance in connection with assessments required for international transfers of personal data under applicable data protection legislation.

In case such assistance requires additional measures or work to be performed by the Trustmary Contracting Entity, the Trustmary Contracting Entity has the right to charge the Customer an hourly consulting fee for such assistance in accordance with the Trustmary Contracting Entity’s then-current rates for consulting services, subject to the Customer’s prior approval of such additional costs.

4. Subprocessors

The Customer gives its general authorization to allow the Trustmary Contracting Entity to engage third parties and entities within the Trustmary group as subprocessors to process personal data in connection with the provision of the Service.

The Trustmary Contracting Entity is free to choose and change its subprocessors. The subprocessors currently used by the Trustmary Contracting Entity are listed here. For the avoidance of doubt, where the Trustmary Contracting Entity is Trustmary Finland Oy, Trustmary Group Oy acts as its subprocessor for the provision of the Service delivered to the Customer.

The Trustmary Contracting Entity shall inform the Customer in writing of any intended addition or replacement of a subprocessor at least seven (7) days before the relevant subprocessor begins processing personal data, thereby giving the Customer a reasonable opportunity to object to such change. If the Trustmary Contracting Entity is not willing to change the subprocessor the Customer has objected to, both Parties shall have the right to terminate the Agreement and this DPA.

Where the Trustmary Contracting Entity engages a subprocessor for carrying out specific processing activities on behalf of the Customer, the same data protection obligations as set out in this DPA shall be included in the DPA between the Trustmary Contracting Entity and that subprocessor. Where a subprocessor fails to fulfil its data protection obligations, the Trustmary Contracting Entity shall remain fully liable to the Customer for the performance of the subprocessor’s obligations.

5. Use of AI Technologies

The Customer acknowledges that the Trustmary Contracting Entity and its subprocessors may use artificial intelligence-based technologies in connection with the provision of the Service.

The Trustmary Contracting Entity shall ensure that personal data covered by this DPA is processed using such technologies only for the processing activities described in this DPA.

Where an artificial intelligence service provider processes personal data on behalf of the Trustmary Contracting Entity, it shall be treated as a subprocessor in accordance with Section 4 and shall be subject to the same data protection obligations as apply to the Trustmary Contracting Entity under this DPA. For the sake of clarity, the Trustmary Contracting Entity shall require such subprocessors not to use said personal data to train, develop or improve their general-purpose artificial intelligence models. Any transfer of personal data outside the EEA in connection with such processing shall be carried out in accordance with Section 6.

6. International Transfers

The Customer accepts that the Trustmary Contracting Entity may transfer personal data to, or permit access to personal data by, its subprocessors outside the European Economic Area (“EEA”) in connection with the provision of the Service.

If personal data is transferred from the EEA for processing in any country outside the EEA that is not recognized by the European Commission as providing an adequate level of protection for personal data, the Trustmary Contracting Entity shall ensure that an appropriate transfer mechanism under Chapter V of the GDPR is in place. Such mechanism may include the then-current standard contractual clauses adopted or approved by the European Commission, using the module applicable to the relevant transfer, or another appropriate safeguard or transfer mechanism permitted under the GDPR.

Upon request, the Trustmary Contracting Entity will provide the Customer with information regarding the supplementary safeguards adopted for the international transfers, including information about implemented supplementary measures to protect personal data within the jurisdiction it is being transferred to.

7. Audits

The Customer or an auditor appointed by the Customer shall with the assistance of the Trustmary Contracting Entity have the right to audit the processing activities of the Trustmary Contracting Entity under this DPA to assess its compliance with this DPA and applicable data protection legislation. Any such audit shall be conducted during the Trustmary Contracting Entity’s ordinary business hours, with at least 30 days’ prior written notice, and in a manner that does not unreasonably interfere with the Trustmary Contracting Entity’s business operations. The Customer shall be responsible for the costs incurred by the Trustmary Contracting Entity or the Customer in relation to the audit.

Unless otherwise required by applicable data protection legislation or a competent supervisory authority, or reasonably necessary following a personal data breach or other material data protection incident affecting the Customer’s personal data, the Customer may conduct such an audit no more than once in any twelve-month period. Any on-site audit shall be limited to what is reasonably necessary to verify compliance with this DPA. Where reasonably sufficient to demonstrate compliance, the Trustmary Contracting Entity may satisfy an audit request by providing relevant information, documentation, certifications or independent third-party audit reports available to it.

Where an audit may, in the Trustmary Contracting Entity’s sole opinion, lead to the disclosure of trade secrets or other confidential information of the Trustmary Contracting Entity or threaten the intellectual property rights of the Trustmary Contracting Entity, the Customer shall employ an independent auditor, that is not a competitor of the Trustmary Contracting Entity, to carry out the audit, and the auditor shall agree to be bound to confidentiality for the benefit of the Trustmary Contracting Entity.

In case a request or audit requires additional measures or work to be performed by the Trustmary Contracting Entity beyond the information and assistance reasonably available in the ordinary course of business, the Trustmary Contracting Entity has the right to charge the Customer an hourly consulting fee in accordance with the Trustmary Contracting Entity’s then-current rates for consulting services, subject to the Customer’s prior approval of such additional costs.

8. Erasure or Return of Personal Data

Within a reasonable time after the termination or expiry of the Agreement or after the Customer has permanently ceased to use the Service, the Trustmary Contracting Entity shall, as instructed by the Customer, delete or return to the Customer all personal data processed on behalf of the Customer, except to the extent that applicable European Union or Member State law requires the continued storage of such personal data.

Notwithstanding the foregoing, personal data contained in routine backup or archival systems may be retained until deleted in accordance with the Trustmary Contracting Entity’s standard retention and deletion procedures, to the extent that immediate deletion from such systems is not reasonably or technically feasible, provided that such personal data remains protected in accordance with this DPA and is not further processed except as necessary for backup restoration, security or compliance with applicable law.

9. Customer Privacy Policy

The Customer is responsible for ensuring that data subjects are provided with all information required under applicable data protection legislation in respect of personal data for which the Customer acts as the data controller. The Customer shall provide to the Trustmary Contracting Entity its applicable privacy policy pertaining to such personal data for which the Customer acts as the data controller in accordance with the instructions given in the Service. This can be done by uploading the privacy policy to the platform, from where it is shown to data subjects leaving feedback to Customer via the Trustmary Service.