Casentra — Data Processing Addendum (DPA) v2.0

This Data Processing Addendum forms part of the Casentra Terms of Service. In the event of inconsistency, the English version prevails.

1. Scope and Roles

1.1This DPA applies where Casentra processes Client Data on behalf of Customer in providing the Service.

1.2Customer acts as the data user/controller or authorised representative of the relevant data user, depending on the applicable relationship. Casentra acts as a data processor/service provider when processing Client Data on Customer's documented instructions.

1.3Customer is responsible for ensuring that Client Data is collected, disclosed and processed lawfully, including providing required notices and obtaining necessary consents, permissions or authorisations under applicable laws and regulatory requirements.

(b)as necessary to provide, maintain, secure and support the Service; or

2. Processing Instructions and Purpose Limitation

2.1Casentra does not use identifiable Client Data, prompts, uploaded files or Customer-specific content submitted through the Service to train or fine-tune general-purpose AI models for unrelated customers.

2.2Casentra may process Client Data as technically necessary to provide AI Features requested by Customer, including generating Outputs and operating the Service.

2.3Casentra may use aggregated, anonymised or de-identified information that does not reasonably identify Customer, any client or any individual for purposes including analytics, security, reliability, performance optimisation and improvement of the Service, where permitted by Applicable Laws.

3. Confidentiality

Casentra treats Client Data as confidential and restricts access to personnel and service providers who need access to provide, maintain or secure the Service. Such parties are subject to appropriate confidentiality obligations.

4. Security Measures

Casentra maintains reasonable technical and organisational measures designed to protect Client Data against unauthorised access, disclosure, alteration, loss or misuse.

Security measures may be updated from time to time as technology, risks and the Service evolve.

Casentra's primary application infrastructure may be hosted in Hong Kong. Certain Service features, including AI-powered functionality, may require Client Data to be processed by third-party technology providers located outside Hong Kong. Such processing will be conducted subject to applicable contractual, technical and organisational safeguards.

5. Subprocessors

5.1Customer authorises Casentra to engage subprocessors to process Client Data.

·Other technology providers necessary to provide the Service.

5.2Casentra maintains a current list of material subprocessors and may update such list from time to time.

5.3Casentra requires subprocessors to undertake obligations relating to confidentiality, security and data protection that are appropriate to the services provided.

5.4Casentra remains responsible for its subprocessors' processing activities to the extent required by Applicable Laws.

6. International Transfers

Where Client Data is transferred internationally, Casentra will implement reasonable contractual, technical and organisational safeguards appropriate to the nature of the processing and applicable legal requirements.

7. Data Subject Requests

Taking into account the nature of processing, Casentra will provide reasonable assistance to Customer in responding to requests from individuals relating to Client Data.

Where an individual contacts Casentra directly regarding Client Data, Casentra may direct the individual to Customer and provide reasonable assistance where appropriate.

8. Personal Data Breaches

Casentra will notify Customer without undue delay after becoming aware of a confirmed personal data breach affecting Client Data.

Where reasonably available, Casentra will provide information regarding the nature of the breach, affected data categories, likely impact, mitigation measures and relevant updates as information becomes available.

9. Return and Deletion

Upon termination or Customer's written instruction, Casentra will delete or return Client Data in accordance with applicable legal requirements, contractual obligations and Casentra's retention policies.

Backup copies may remain temporarily until overwritten through normal backup cycles.

10. Records and Audit

Casentra will make available information reasonably necessary to demonstrate compliance with this DPA.

Customer shall first request reasonably available compliance information before conducting an audit.

Any audit shall be conducted on reasonable prior notice, subject to confidentiality obligations and without unreasonable disruption to Casentra's operations.

11. Government and Law Enforcement Requests

If Casentra receives a legally binding request from an authority for Client Data, Casentra will, unless legally prohibited, notify Customer and disclose only the information legally required.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Casentra Terms of Service.

13. General Terms

This DPA forms part of the Casentra Terms of Service. Capitalised terms not defined in this DPA have the meanings given in the Terms of Service.