Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between TaggIQ Limited ("TaggIQ", "Processor") and the Customer ("Controller") and governs the Processing of Personal Data by TaggIQ on behalf of the Customer in connection with the Service.

This DPA is entered into to enable compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Act 2018, and, where applicable, the United Kingdom GDPR.

In the event of any conflict between this DPA and the Terms of Service in relation to the Processing of Personal Data, this DPA prevails to the extent of the conflict.

1. Definitions

Capitalised terms not defined in this DPA have the meaning given in the Terms of Service. In addition:

• "Applicable Data Protection Law" means the GDPR, the Irish Data Protection Act 2018, the United Kingdom GDPR where applicable, and any other law governing the Processing of Personal Data that applies to either party.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", "Personal Data Breach", and "Special Category Data" have the meanings given in Article 4 of the GDPR.
• "Customer Personal Data" means Personal Data Processed by TaggIQ on behalf of the Customer in connection with the Service.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor) where TaggIQ acts as Processor, and Module Three (Processor to Sub-Processor) where TaggIQ engages a Sub-Processor outside the EEA.
• "Sub-Processor" means any third party engaged by TaggIQ to Process Customer Personal Data on behalf of the Customer.
• "Supervisory Authority" means the Irish Data Protection Commission and, where the Customer is established in another EU/EEA Member State, the supervisory authority for that Member State.
• "Working Day" means a day other than a Saturday, Sunday, or public holiday in Ireland.

2. Roles and Scope

2.1 Controller and Processor

The Customer is the Controller of Customer Personal Data. TaggIQ is the Processor and shall Process Customer Personal Data only on the Customer's documented instructions (as set out in Section 4) and as required by Applicable Data Protection Law. Where Applicable Data Protection Law requires Processing, TaggIQ shall inform the Customer of that legal requirement before Processing, unless the law prohibits such notice.

2.2 TaggIQ as Independent Controller

For the avoidance of doubt, TaggIQ acts as an independent Controller (and not as the Customer's Processor) in respect of: (a) the Customer's account-administrator data used by TaggIQ for billing, account management, security, and service administration; (b) aggregated, anonymised usage data; (c) data Processed for fraud detection, abuse prevention, and platform security; and (d) data Processed for TaggIQ's own marketing and sales outreach. TaggIQ's privacy practices in respect of these activities are governed by its Privacy Policy, not this DPA.

2.3 Third-Party Independent Controllers

Where the Customer enables third-party integrations (for example, Stripe Connect, Xero, QuickBooks Online, Google Drive, Google Workspace/Gmail, or Canva), those third parties may act as independent Controllers (or, where applicable, joint Controllers) for Personal Data they Process under their own customer-facing terms and privacy notices. To the extent TaggIQ uses those providers to Process Customer Personal Data on the Customer's behalf in delivering the enabled integration, they are listed as Sub-Processors in Annex III and are subject to Section 7.

2.4 Customer Representations and Warranties

The Customer represents and warrants that:

• it has a lawful basis under GDPR Article 6 (and, where applicable, Article 9) for all Customer Personal Data it uploads to or generates within the Service;
• it will not knowingly upload Special Category Data to the Service; the Service is not designed for, and TaggIQ does not warrant the Service as appropriate for, Special Category Data;
• it will not knowingly upload Personal Data of Data Subjects under 16 years of age, or any lower age threshold under applicable Member State law;
• it has provided all required information to, and obtained all required consents from, Data Subjects (including End Customers transacting through WebStores) in relation to the Processing contemplated by this DPA;
• the instructions it gives TaggIQ comply with Applicable Data Protection Law.

The Customer shall indemnify TaggIQ for any losses, fines, claims, or damages arising from a breach of this Section 2.4.

3. Nature, Purpose, and Duration of Processing

Annex I sets out the categories of Data Subjects, categories of Personal Data, nature and purpose of Processing, frequency of Processing, and retention periods.

Processing continues for the duration of the Customer's subscription to the Service and ceases on termination, subject to the deletion and return provisions in Section 13 and the data-export period in the Terms of Service Section 20.3.

4. Controller Instructions

4.1 Documented Instructions

The Customer's documented instructions to TaggIQ are set out in:

• the Terms of Service;
• this DPA (including its Annexes);
• the Service's configuration as set by the Customer through the Service interface (including enabling integrations, configuring data-retention settings, granting access to Authorised Users); and
• any further written instruction agreed in writing by both parties.

4.2 Additional Instructions

If the Customer issues an instruction outside the scope of Section 4.1, TaggIQ may: (a) charge a reasonable fee for assessing and implementing it; or (b) decline it where doing so is necessary to maintain the integrity, security, or availability of the Service for other customers.

4.3 Notification of Unlawful Instructions

TaggIQ shall promptly notify the Customer if it believes an instruction infringes Applicable Data Protection Law. TaggIQ may suspend execution of any instruction it reasonably believes infringes Applicable Data Protection Law pending clarification from the Customer.

5. Processor Obligations

In accordance with GDPR Article 28(3), TaggIQ shall:

• Process Customer Personal Data only on the Customer's documented instructions and as required by Applicable Data Protection Law (with notice to the Customer where permitted);
• ensure that persons authorised to Process Customer Personal Data have committed themselves to confidentiality or are under appropriate statutory obligations of confidentiality;
• implement and maintain the technical and organisational measures set out in Annex II;
• take all measures required by GDPR Article 32 (security of Processing);
• engage Sub-Processors only in accordance with Section 7;
• taking into account the nature of Processing, assist the Customer in fulfilling its obligation to respond to Data Subject requests, by providing the technical functionality described in Section 10;
• taking into account the nature of Processing and the information available to TaggIQ, assist the Customer in ensuring compliance with GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments, prior consultation), to the extent reasonably required;
• at the Customer's choice, delete or return all Customer Personal Data after the end of the Agreement, as set out in Section 13;
• make available to the Customer the information necessary to demonstrate compliance with Article 28 obligations, and allow for and contribute to audits as set out in Section 12.

6. Security Measures

TaggIQ implements and maintains the technical and organisational measures set out in Annex II, which include encryption in transit and at rest, multi-tenant isolation, role-based access control, brute-force protection, audit logging, and incident response procedures.

TaggIQ may modify the measures in Annex II from time to time, provided the overall level of security is not materially reduced. Material reductions require thirty (30) days' prior written notice to the Customer.

7. Sub-Processors

7.1 General Authorisation

The Customer grants TaggIQ general written authorisation under GDPR Article 28(2) to engage Sub-Processors to Process Customer Personal Data, subject to this Section 7.

7.2 Current Sub-Processors

The Sub-Processors authorised at the date of this DPA are listed in Annex III, together with their identity, role, the categories of Personal Data they Process, their location, and the basis on which any transfer outside the EEA is lawful.

7.3 Notice of New Sub-Processors

TaggIQ shall notify the Customer in writing (by email to the address registered for the Customer's billing contact, by notice posted within the Customer's account, or by an update to the published list at https://taggiq.com/dpa) of the proposed engagement of a new Sub-Processor, or a material change to an existing one, at least thirty (30) days before that Sub-Processor begins Processing Customer Personal Data.

7.4 Right to Object

The Customer may, within fifteen (15) days of TaggIQ's notification under Section 7.3, object in writing to the engagement of a new Sub-Processor on reasonable grounds relating to the protection of Personal Data. The parties shall discuss the objection in good faith. If the parties cannot resolve the objection within a further fifteen (15) days, the Customer may terminate the affected portion of the Service (or, if the Sub-Processor is essential to the Service and cannot be replaced or excluded, the Service in its entirety) by written notice. TaggIQ will refund any pre-paid Fees for the unused remainder of the then-current subscription term in respect of the terminated portion.

7.5 Sub-Processor Obligations

TaggIQ shall enter into a written agreement with each Sub-Processor that imposes data-protection obligations no less protective than those in this DPA, including obligations relating to security, onward sub-processing, international transfers, confidentiality, and Data Subject rights assistance.

7.6 Sub-Processor Liability

TaggIQ remains liable to the Customer for the acts and omissions of its Sub-Processors in relation to their Processing of Customer Personal Data, to the same extent TaggIQ is liable for its own acts and omissions, subject to the limitation of liability in Section 14.

8. International Data Transfers

8.1 Primary Storage Location

Customer Personal Data is hosted in the European Union (Amazon Web Services region eu-west-1, Ireland). Disaster-recovery backups are replicated to an additional region (eu-west-2, London, United Kingdom), which is covered by the European Commission's adequacy decision for the United Kingdom under GDPR Article 45.

8.2 Transfers Outside the EEA

Where Sub-Processors or third-party integrations cause Customer Personal Data to be transferred outside the European Economic Area, TaggIQ relies on one or more of the following lawful transfer mechanisms:

• an adequacy decision adopted by the European Commission under GDPR Article 45;
• the European Commission Standard Contractual Clauses (Decision (EU) 2021/914), Module Two where TaggIQ exports Customer Personal Data to a Sub-Processor outside the EEA, or Module Three where TaggIQ engages a non-EEA Sub-Processor onward;
• for transfers to the United States, the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the Sub-Processor is certified under that framework, combined with SCCs as a fallback safeguard;
• supplementary technical measures including encryption in transit and at rest, application-level encryption of credentials, and pseudonymisation where appropriate.

8.3 Incorporation of SCCs

For the purposes of the SCCs, the Customer is the data exporter and TaggIQ (or the relevant onward recipient) is the data importer. By accepting this DPA, the Customer is deemed to have entered into the SCCs in respect of each non-EEA Sub-Processor identified in Annex III. The Customer may request execution of standalone SCCs at privacy@taggiq.com.

8.4 UK Transfers

For transfers from the United Kingdom, the parties shall apply the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as published by the Information Commissioner's Office, as applicable.

9. Personal Data Breach

9.1 Notification

TaggIQ shall notify the Customer of any Personal Data Breach affecting Customer Personal Data without undue delay and in any event within seventy-two (72) hours of TaggIQ becoming aware of the Breach.

9.2 Content of Notification

To the extent the information is available, the notification shall include: (a) the nature of the Breach, including the categories and approximate number of Data Subjects and records affected; (b) the likely consequences of the Breach; (c) the measures taken or proposed to address the Breach and to mitigate its possible adverse effects; and (d) contact details for further enquiries. Where some information is not available at the time of the initial notification, TaggIQ shall provide the missing information in subsequent updates as it becomes available.

9.3 Cooperation

TaggIQ shall reasonably cooperate with the Customer in investigating, mitigating, and remediating the Breach, including by providing information necessary for the Customer to meet its own notification obligations to the Supervisory Authority under GDPR Article 33 and to Data Subjects under GDPR Article 34.

9.4 No Implied Acknowledgement

A notification under this Section 9 is not, and shall not be construed as, an acknowledgement of fault, liability, or contravention of law by TaggIQ.

10. Data Subject Rights

10.1 Routing of Requests

If TaggIQ receives a request from a Data Subject in relation to Customer Personal Data (including a request for access, rectification, erasure, restriction, portability, or objection), TaggIQ shall not respond directly except on the Customer's documented instructions or as required by law. TaggIQ shall, without undue delay (and in any event within five (5) Working Days), forward the request to the Customer for handling.

10.2 Technical Assistance Available Through the Service

Taking into account the nature of Processing, the Service provides the Customer with the following functionality to assist in responding to Data Subject requests:

• per-resource CSV export of Customer Personal Data through the Service interface, currently available for customer, lead, quote, order, invoice, purchase order, vendor, and product records (right of access, right to portability);
• standard create, read, update, and delete operations on Customer Personal Data through the Service interface (right to rectification);
• deletion of individual Customer Personal Data records through the Service interface, with cascade to related transactional records (right to erasure, subject to retention obligations under Applicable Data Protection Law).

10.3 Extended Assistance

On written request to privacy@taggiq.com, TaggIQ shall assist the Customer with export, rectification, restriction, or erasure tasks that cannot reasonably be performed through the Service interface. TaggIQ shall use commercially reasonable efforts to respond within ten (10) Working Days. TaggIQ may charge a reasonable fee for assistance that materially exceeds standard usage of the Service.

10.4 Customer's Role

The Customer remains primarily responsible for responding to Data Subjects in relation to Customer Personal Data. Where the Customer's End Customers (for example, WebStore buyers or enquiry-form submitters) submit Data Subject requests, the Customer is the Controller and must respond.

11. Confidentiality of Processing

TaggIQ shall ensure that any person authorised to Process Customer Personal Data (including TaggIQ employees, contractors, and Sub-Processor personnel where TaggIQ has control over them) is bound by a written obligation of confidentiality, whether contractual or statutory, that applies during and after the person's engagement with TaggIQ.

12. Audit Rights

12.1 Compliance Information

On the Customer's reasonable written request (not more than once per twelve (12) months unless triggered by a confirmed Personal Data Breach), TaggIQ shall make available information reasonably necessary to demonstrate compliance with this DPA and GDPR Article 28, in one or more of the following forms:

• written responses to industry-standard compliance questionnaires (for example, CAIQ or SIG);
• copies of relevant third-party certifications, audit reports, or attestations covering TaggIQ's infrastructure Sub-Processors (for example, AWS SOC 2 reports, ISO 27001 attestations);
• copies of TaggIQ's information-security policy summary and incident-response procedure summary.

12.2 On-Site Audit

TaggIQ is not obligated to permit on-site audits of its own premises or systems, except where:

• a Supervisory Authority requires such an audit by binding order;
• a confirmed Personal Data Breach materially affecting the Customer has occurred within the preceding twelve (12) months and the Customer demonstrates reasonable cause for an on-site audit; or
• the parties otherwise agree in writing.

Where an on-site audit is permitted, it shall be conducted on at least thirty (30) days' written notice, during normal business hours, in a manner that does not unreasonably interfere with TaggIQ's operations or the security and confidentiality of other customers' data. The auditor shall be subject to confidentiality obligations no less protective than those in the Terms of Service Section 18, shall not be a competitor of TaggIQ, and shall not require access to other customers' data.

12.3 Costs

The Customer bears its own costs of any audit. TaggIQ's reasonable costs in cooperating with an audit are at the Customer's expense, except where the audit identifies a material breach of this DPA by TaggIQ, in which case TaggIQ bears its own cooperation costs.

13. Deletion and Return

13.1 Export Period

On termination of the Agreement for any reason, the Customer retains access to data-export functionality for thirty (30) days, as set out in the Terms of Service Section 20.3.

13.2 Deletion

After the export period, TaggIQ shall delete Customer Personal Data from primary production systems within ninety (90) days, and from backups within one hundred and eighty (180) days, unless retention is required by Applicable Data Protection Law (in which case retained data shall remain subject to the security and confidentiality obligations of this DPA for the period of retention).

13.3 Statutory Retention

Notwithstanding Section 13.2, TaggIQ may retain Customer Personal Data necessary to comply with statutory record-keeping obligations, including:

• financial records for up to seven (7) years (Taxes Consolidation Act 1997, s. 886);
• records of Processing activities for the period of TaggIQ's accountability obligation under GDPR Article 30;
• records relating to ongoing disputes, claims, or legal proceedings.

13.4 Certification

On written request from the Customer (sent within ninety (90) days after the export period ends), TaggIQ shall provide written certification of deletion.

14. Liability

14.1 Cross-Reference

The limitations and exclusions of liability set out in the Terms of Service Section 16 apply to claims arising under or in connection with this DPA, as modified by this Section 14.

14.2 Statutory Carve-Out

Nothing in this DPA limits either party's liability:

• for administrative fines imposed under GDPR Article 83 to the extent the fine relates to that party's own breach of Applicable Data Protection Law;
• for compensation paid to a Data Subject under GDPR Article 82 to the extent it relates to that party's own breach of Applicable Data Protection Law;
• where such limitation is prohibited by Applicable Data Protection Law.

14.3 Each Party's Own Breach

Each party is liable for its own breaches of Applicable Data Protection Law and is not liable for the other party's breaches, except where it can be shown that the other party caused or materially contributed to the breach through reliance on the first party's compliance representations.

14.4 Article 82

For the avoidance of doubt, this Section 14 does not exclude or limit a Data Subject's right to compensation under GDPR Article 82 as against either party.

15. Conflicts

In the event of any conflict between this DPA and the Terms of Service in relation to the Processing of Personal Data, this DPA prevails to the extent of the conflict. In the event of any conflict between this DPA and the SCCs (where the SCCs apply to a particular transfer), the SCCs prevail.

16. Term and Survival

16.1 Term

This DPA takes effect on the date the Customer accepts the Agreement and remains in force for the duration of the Agreement.

16.2 Survival

The following Sections survive termination of the Agreement: Section 2 (Roles and Scope), Section 8 (International Transfers) in respect of Processing prior to termination, Section 9 (Personal Data Breach) in respect of Breaches notified before termination, Section 11 (Confidentiality), Section 12 (Audit) in respect of Processing carried out before termination, Section 13 (Deletion and Return), Section 14 (Liability), Section 15 (Conflicts), Section 17 (Governing Law), and any other provision that by its nature should survive.

17. Governing Law

This DPA is governed by the laws of Ireland, consistent with the Terms of Service Section 22. Disputes arising under or in connection with this DPA are subject to the exclusive jurisdiction of the courts of Ireland, save that nothing in this DPA prevents a Data Subject from bringing proceedings in their place of habitual residence as permitted by Applicable Data Protection Law.

Annex I: Processing Details

A. Subject Matter

Provision of the TaggIQ Service to the Customer.

B. Duration

For the duration of the Customer's subscription, plus any retention period required by law (see Section 13).

C. Nature and Purpose

Hosting, storage, retrieval, modification, transmission, and deletion of Customer Personal Data as part of providing point-of-sale, quoting, ordering, invoicing, payment, supplier integration, WebStore, accounting-sync, and related functionality.

D. Categories of Data Subjects

• the Customer's authorised users (employees and representatives accessing the Service);
• the Customer's own business customers and contacts (whose data the Customer manages within the Service);
• the Customer's suppliers and supplier contacts;
• End Customers transacting through the Customer's WebStores;
• visitors to the Customer's WebStores or public-facing pages submitting enquiry, quote-approval, or artwork-approval forms.

E. Categories of Personal Data

• Identity data: name, job title, company name.
• Contact data: email address, phone number, postal address.
• Account data: username, role, hashed password, login timestamps, IP address, user agent.
• Transaction data: quote, order, invoice, payment amount and status; shipping and billing addresses; tax identifiers. Full payment card numbers (PANs) are processed by Stripe and are not stored by TaggIQ.
• Communication data: emails sent through the Service, including recipients, sender mailbox, subject, body, attachments, provider message identifiers, artwork approvals, and enquiry submissions.
• Usage data: feature interactions, navigation events, and session metadata; organisation-scoped within the Service and aggregated/anonymised before use in any cross-customer analytics.
• Encrypted credential data: OAuth tokens for Customer-enabled integrations (Xero, QuickBooks Online, Google Drive, Google Workspace/Gmail, Canva) and supplier API credentials, encrypted at rest at the application layer using Fernet symmetric encryption.

F. Special Category Data

None. The Service is not designed for, and TaggIQ does not warrant the Service as appropriate for, Special Category Data (GDPR Article 9). The Customer warrants it will not knowingly upload such data (Section 2.4(b)).

G. Frequency

Continuous during the term of the Agreement.

H. Retention Periods

• Active account and Customer Personal Data: for the duration of the subscription plus thirty (30) days after termination (export window).
• After the export window: deletion from primary systems within ninety (90) days; deletion from backups within one hundred and eighty (180) days.
• Financial records: up to seven (7) years (Irish tax law).
• Identity audit log entries: up to twelve (12) months for user actions; up to thirty (30) days for system actions.
• Webhook event records: ninety (90) days.
• Approval-token audit records: seven (7) days.

Annex II: Technical and Organisational Measures

The following technical and organisational measures are implemented in TaggIQ's production environment as of the date of this DPA. TaggIQ may update these measures from time to time, provided the overall level of security is not materially reduced.

A. Encryption

• In transit: TLS 1.2 or higher is enforced for all connections between client browsers, TaggIQ infrastructure, and Sub-Processor APIs. HTTP-to-HTTPS redirect is enforced; HSTS is applied with a one-year max-age and includeSubDomains. Cookies are marked Secure, HttpOnly, and SameSite.
• At rest (database): The primary database (Amazon RDS PostgreSQL) is encrypted at rest using AWS-managed keys.
• At rest (object storage): Object storage (Amazon S3) uses AES-256 server-side encryption.
• At rest (cache): The caching layer (Amazon ElastiCache Redis) is configured for in-transit and at-rest encryption; production environments boot-fail if non-TLS Redis URLs are configured.
• Application-level credential encryption: OAuth tokens for Customer-enabled integrations and supplier API credentials are encrypted at the application layer using Fernet symmetric encryption, with key material held separately from the database.

B. Multi-Tenant Isolation

• Every Customer-owned record carries an organisation identifier enforced as a foreign key. Cascading rules ensure data follows the tenant boundary.
• A dedicated tenant-resolution middleware binds the active tenant from a signed JWT claim on every request. Cross-tenant access is denied at the permission layer.
• Continuous integration enforces tenant-isolation invariants on every commit, including: a static-analysis gate that forbids unsafe tenant-resolution patterns across the entire backend codebase; an AST-based audit that asserts every API endpoint applies organisation filtering; and integration tests verifying that cross-tenant data access is rejected at the financial-calculator, payment, administrative, and search layers.

C. Access Control

• Authentication: JWT Bearer tokens with short-lived access tokens (four hours) and rotating refresh tokens (seven days).
• Password hashing: PBKDF2 with SHA-256 and random salt (Django default), subject to length, similarity, common-password, and numeric-only validators.
• Brute-force protection: account lockout after ten (10) failed login attempts from the same IP/username pair, for thirty (30) minutes (django-axes).
• Role-based access control: within each tenant, roles include Owner, Manager, Sales, Production, and Viewer. A view-only permission class enforces read-only access for Viewer-role users on every write endpoint.
• Administrative interface protection: multi-factor authentication (TOTP) for all TaggIQ staff with administrative privileges; an obfuscated URL prefix (production boot-fails if unset); and an IP allowlist that returns HTTP 404 (not 403) for non-allowlisted clients.

D. Logging and Monitoring

• Structured JSON application logs shipped to AWS CloudWatch Logs (EU region only).
• An immutable identity-audit log records authentication events, organisation switches, membership changes, role changes, password and email changes, and permission denials.
• A general audit log captures create / update / delete operations across business-critical models, with organisation scope, IP address, and user-agent context.
• Daily automated error analysis runs on a sliding 24-hour window of CloudWatch logs, processed by AWS Bedrock (Claude model, EU region only). The analysis prompt mandates a P0 classification for any multi-tenant isolation anomaly. Results are emailed to TaggIQ's operations contact.
• Slow-request detection (greater than two seconds) is logged with user, organisation, path, and duration for diagnosis.

E. Network and Application Security

• Content Security Policy enforced via middleware with restrictive script and connect sources.
• Rate limits applied to anonymous (120/min), authenticated (600/min), login (5/min), trial signup (10/hour), Personal Access Token creation (20/hour), and public endpoints (5-10/min as appropriate).
• Webhook signatures verified before processing inbound payment-provider events; signature secrets required at boot.
• Bot detection (Cloudflare Turnstile) mandatory on public signup endpoints in production.
• Cross-Origin Resource Sharing (CORS) restricted to allowlisted production origins.

F. Backup and Recovery

• Automated daily database backups with thirty-five (35) day retention.
• Cross-region backup copy to the United Kingdom region (eu-west-2), covered by EU adequacy decision.
• Deletion protection enabled on production database resources.
• Object storage versioning to protect against accidental deletion or corruption.
• Manual snapshot taken before each production deployment.

G. Vulnerability Management

• Dependency vulnerability scanning on the Python and Node.js dependency trees.
• Branch protection requiring pull-request review and continuous-integration pass before merge to the protected branch.
• An evolving set of static-analysis gates (currently more than twenty) prevents reintroduction of known classes of bug, including financial-precision regressions, AI/financial-write coupling, file-size growth, regression-map drift, and inline-math duplication.
• A documented incident-response procedure covering detection, classification, containment, eradication, recovery, and post-incident review.

H. Personnel

• All TaggIQ personnel with access to production data are bound by written confidentiality obligations that survive their engagement.
• Access to production data is restricted to personnel who require it for their role, granted on a least-privilege basis, and logged.
• Access is revoked promptly on role change or departure.

I. Sub-Processor Management

• Each Sub-Processor is engaged under a written contract imposing data-protection obligations equivalent to those in this DPA.
• Sub-Processor changes are subject to the notice and objection process in Section 7.
• The current Sub-Processor list is maintained in Annex III and on the published version of this DPA at https://taggiq.com/dpa.

Annex III: Current Sub-Processors

As of 3 August 2026, the following Sub-Processors are authorised to Process Customer Personal Data:

By accepting this DPA the Customer authorises engagement of the Sub-Processors listed above. The Customer is responsible for entering into separate data-protection arrangements with any Customer-enabled third-party integration (Xero, QuickBooks Online, Google Drive, Google Workspace/Gmail, Canva) where that integration acts as an independent Controller of the Customer's data outside the Service. Updates to this list are made in accordance with Section 7.

Change Record

3 August 2026. The Google entry was updated to include Google Workspace/Gmail send-only email delivery using the gmail.send scope, and the corresponding communication-data and encrypted-credential descriptions were clarified. Google Workspace/Gmail sending is Customer-enabled only and does not permit TaggIQ to read, list, search, or otherwise access mailbox contents.

15 July 2026. The Slack and Atlassian entries were added to this Annex on this date. Both Sub-Processors began Processing on 10 June 2026, when TaggIQ's in-product support assistant went live. TaggIQ did not give the thirty (30) days' advance notice required by Section 7.3 before that Processing began. This Annex records that fact rather than implying otherwise.

The fifteen (15) day objection period in Section 7.4 runs from the date TaggIQ notifies the Customer of this update, not from the date Processing began. A Customer who objects on reasonable grounds relating to the protection of Personal Data may exercise the rights in Section 7.4 in full, including termination of the affected portion of the Service and refund of pre-paid Fees, notwithstanding that the Processing has already commenced. A Customer who wishes the Processing to stop in the meantime may contact privacy@taggiq.com.

15 July 2026. The Google, Canva, and Cloudflare entries, already disclosed in this Annex, were added to the corresponding table in the Privacy Policy on this date. Their Processing and the transfer bases for it are unchanged.

Annex IV: US Privacy Law Addendum (CCPA/CPRA and Multi-State)

A. Scope and Application

This Annex IV applies in addition to the rest of this DPA where: (a) the Customer is a business established or principally operating in the United States; or (b) the Customer's Processing through the Service includes the personal information of US residents protected under Applicable US Privacy Law. In the event of conflict between this Annex IV and the rest of this DPA in relation to the personal information of US residents, this Annex IV prevails to the extent of the conflict.

B. Definitions

For the purposes of this Annex IV:

• "Applicable US Privacy Law" means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA"), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), the Montana Consumer Data Privacy Act (MCDPA), and any other US state law granting comparable rights to its residents and imposing comparable obligations on Businesses, Controllers, Service Providers, Contractors, or Processors.
• "Business" has the meaning given in CCPA §1798.140(d).
• "Consumer" means a natural person who is a resident of a US state with Applicable US Privacy Law and whose personal information is Processed in connection with the Service.
• "Personal Information" means personal information as defined in CCPA §1798.140(v), and comparable defined terms under other Applicable US Privacy Law.
• "Sale" and "Share" have the meanings given in CCPA §1798.140(ad) and §1798.140(ah).
• "Sensitive Personal Information" has the meaning given in CCPA §1798.140(ae).
• "Service Provider" and "Contractor" have the meanings given in CCPA §1798.140(ag) and §1798.140(j).

C. TaggIQ as Service Provider / Processor

For the purposes of Applicable US Privacy Law, the Customer is the "Business" or "Controller" and TaggIQ is the "Service Provider", "Contractor", or "Processor" (as the case may be) with respect to Personal Information of Consumers Processed in connection with the Service. TaggIQ Processes such Personal Information only for the limited and specified purposes set out in Section 3 and Annex I of this DPA, and only on behalf of the Customer.

D. Mandatory Restrictions on TaggIQ

TaggIQ shall not:

• Sell or Share the Personal Information;
• retain, use, or disclose the Personal Information for any purpose other than the business purposes specified in this DPA, including for any commercial purpose other than performing the Service, except as expressly permitted by Applicable US Privacy Law;
• retain, use, or disclose the Personal Information outside of the direct business relationship between TaggIQ and the Customer;
• combine the Personal Information with personal information that TaggIQ receives from or on behalf of another person, or that TaggIQ collects from its own interaction with the Consumer, except as expressly permitted by CCPA Regulations §7050(b) (combinations performed solely to detect or respond to security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or comply with legal obligations).

TaggIQ certifies that it understands and shall comply with the restrictions in this Section D.

E. Cooperation with Consumer Rights Requests

On the Customer's written instruction, and using the technical functionality described in Section 10 of this DPA, TaggIQ shall reasonably assist the Customer in fulfilling Consumer requests received under Applicable US Privacy Law, including the rights to know, access, correct, delete, opt out of Sale or Sharing, limit use of Sensitive Personal Information (where applicable), appeal, and non-discrimination.

F. Notice of Non-Compliance

TaggIQ shall notify the Customer in writing if TaggIQ determines that it can no longer meet its obligations under Applicable US Privacy Law in respect of the Personal Information.

G. Right to Stop and Remediate

If the Customer reasonably believes that TaggIQ is Processing Personal Information in an unauthorised manner, the Customer may, on written notice, require TaggIQ to take reasonable and appropriate steps to stop and remediate the unauthorised Processing.

H. Sensitive Personal Information

The Service is not designed for the bulk Processing of Sensitive Personal Information. The Customer shall not knowingly upload Sensitive Personal Information to the Service except: (a) account log-in credentials, which the Service Processes solely for access-control purposes; and (b) any Sensitive Personal Information incidentally captured in free-text fields, which the Customer Processes at its own risk. The Customer's representations and warranties in Section 2.4 of this DPA apply with equal force to Sensitive Personal Information under Applicable US Privacy Law.

I. Sub-Processors as "Contractors" or "Processors"

Each Sub-Processor identified in Annex III, and each future Sub-Processor engaged in accordance with Section 7 of this DPA, is engaged as a Service Provider, Contractor, or Processor (as the case may be) under Applicable US Privacy Law, subject to a written contract that includes restrictions equivalent to those in Section D above.

J. State Breach Notification Assistance

In addition to the 72-hour notification commitment in Section 9 of this DPA, TaggIQ shall provide notification of a Personal Data Breach affecting Personal Information of US Consumers in sufficient time to enable the Customer to meet the breach-notification timing required by applicable US state law (ranging from "without unreasonable delay" to specific timelines of 30, 45, or 60 days depending on the state). On the Customer's reasonable request, TaggIQ shall provide additional information necessary for the Customer to comply with state-specific notification content requirements (including, where applicable, notification to a state attorney general, a state consumer affairs department, or major consumer reporting agencies).

K. Audit

The audit rights in Section 12 of this DPA apply equally to Processing of Personal Information under Applicable US Privacy Law. For the avoidance of doubt, CCPA does not require on-site audit access by Customers.

L. Cumulative Standards

The protections in this Annex IV are cumulative with the protections in the rest of this DPA. Where Applicable US Privacy Law imposes a higher standard than this DPA, the higher standard applies. Where this DPA imposes a higher standard than Applicable US Privacy Law, the DPA standard applies.

M. Liability

For the avoidance of doubt, TaggIQ and the Customer are not jointly and severally liable under Applicable US Privacy Law unless the law itself imposes such liability and that imposition cannot be contracted around. Each party is liable for its own breaches of Applicable US Privacy Law. The limitation of liability in Section 14 of this DPA applies to claims under this Annex IV.

Contact

For all matters under this DPA, including notification of breach, audit requests, escalation of Data Subject requests, and Sub-Processor objections: