DATA PROCESSING AND ROLE ALLOCATION ADDENDUM

This Data Processing and Role Allocation Addendum (“Addendum”) forms part of the agreement between ScoreID B.V. (“ScoreID”) and the entity identified as customer in the applicable order form or master agreement (“Customer”) (together, the “Parties”). It governs Personal Data processed in connection with the contracted ScoreID Services and applies from the effective date of the Agreement or the first relevant processing, whichever is earlier.

The Addendum is modular. The Independent-Controller Module applies where each Party determines its own purposes and essential means. The Processor Module applies only to the processing activities in Annex 1 for which ScoreID processes Customer Personal Data solely on Customer’s documented instructions. The Joint-Controller Module in Annex 6 applies only if the Parties expressly activate it for a processing activity they factually determine together.

The Parties will not use a contractual label to displace the factual allocation required by Applicable Data Protection Law. Processing for direct ScoreID accounts, ScoreID’s core model governance and development where ScoreID determines the purpose, service security, fraud prevention, billing, legal compliance and defence of claims is normally outside the Processor Module and is governed by the Independent-Controller Module and ScoreID Privacy Notice.

“Applicable Data Protection Law” means the GDPR, UK GDPR, applicable EEA/UK implementing law, the Swiss Federal Act on Data Protection where relevant, and applicable U.S. state privacy laws, in each case to the extent applicable to the processing. “Customer Personal Data” means Personal Data processed by ScoreID on behalf of Customer under the Processor Module. “Data Subject”, “Personal Data”, “Personal Data Breach”, “processing”, “controller” and “processor” have the meanings in Applicable Data Protection Law.

“Restricted Transfer” means a transfer of Personal Data that requires an approved transfer mechanism. “SCCs” means the European Commission Standard Contractual Clauses adopted by Decision 2021/914. “UK Addendum” means the then-current UK international data transfer addendum to the EU SCCs. “Subprocessor” means a processor engaged by ScoreID to process Customer Personal Data under the Processor Module.

If this Addendum conflicts with the Agreement on privacy or security, this Addendum prevails. The SCCs or another mandatory transfer instrument prevail over inconsistent terms for a Restricted Transfer. Nothing in this Addendum reduces a statutory right of a Data Subject or power of a supervisory authority.

The order form and Annex 1 must identify the role for each material processing activity. If the factual processing changes, the Parties will review the allocation before deployment. A Party that begins determining a new purpose or essential means may become a controller for that processing and must meet the corresponding obligations.

Each Party is independently responsible for its controller processing, including lawful basis, transparency, purpose limitation, data minimisation, accuracy, retention, rights response, records, impact assessments, security, breach assessment and regulatory cooperation. Neither Party instructs the other in relation to the other Party’s independent purpose.

Customer must provide affected individuals with a notice that accurately identifies Customer’s decision purpose, ScoreID data source or role where required, logic and consequences of profiling, recipient categories, retention, rights and human-review route. Customer may not imply that ScoreID made Customer’s final decision or that a Score is identity/KYC verification, regulatory approval or a guarantee.

Where one Party discloses Personal Data to the other as independent controller, the recipient may process it only for the disclosed and lawful purpose, must apply appropriate security, must not sell or reuse it incompatibly, and must independently satisfy Article 14 or equivalent transparency obligations. The recipient will notify the disclosing Party of a material rights request, regulator inquiry, data-quality issue or misuse relating to the shared data where legally permitted.

For a High-Impact Decision, Customer must not use the Output as the sole or determinative basis unless legally permitted, expressly approved and safeguarded. Customer is responsible for decision notices, explanation, non-discrimination, meaningful human intervention and contest. Annex 5 sets additional independent-controller sharing rules.

ScoreID will process Customer Personal Data only on documented instructions, including the Agreement, order form, approved configuration, Annex 1, authorised API calls and written support directions, unless Union or Member State law requires otherwise. Where legally permitted, ScoreID will inform Customer before legally required processing. ScoreID will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected instruction pending clarification.

Instructions must be specific, lawful and within the Service scope. Additional or materially changed instructions may require a written change order and reasonable fees where they create work beyond the agreed Service. ScoreID will not: sell Customer Personal Data; retain, use or disclose it outside the direct business relationship except as permitted by law; combine it with data from another source except to perform the instructed Service or as otherwise lawfully authorised; or use it for targeted advertising.

ScoreID may process minimum metadata independently for security, billing, fraud prevention, legal compliance and service integrity, provided it acts as controller for that distinct purpose, describes the processing in its Privacy Notice and does not use Customer Personal Data to circumvent the Processor Module.

Customer represents that it is a controller or has the controller’s authority to appoint ScoreID as processor. If Customer is a processor, it warrants that its controller instructions and Article 28 authorisation permit this Addendum and the Subprocessors. Customer remains the single instruction point unless the Parties agree otherwise.

• ensure its instructions, collection, disclosure and intended use comply with Applicable Data Protection Law and the Agreement;
• establish a lawful basis and, where required, an Article 9 or national-law condition;
• provide clear Articles 13–14 notices covering scoring, sources, logic, significance, recipients, retention and rights;
• obtain valid authorisation for Connected Sources and user-directed sharing and preserve evidence;
• submit data that are adequate, relevant, accurate, current and limited to the approved purpose;
• not submit private keys, seed phrases, unnecessary identity documents, children’s data, criminal-offence data or special-category data outside an expressly approved workflow;
• implement meaningful human oversight, explanation, correction, contest and non-discrimination controls for High-Impact Decisions;
• complete any required DPIA, AI Act fundamental-rights impact assessment, fair-lending or model-risk assessment before production use;
• not use a non-FCRA-Enabled Service for a United States eligibility purpose;
• configure access, retention and deletion; manage authorised users; protect credentials; and promptly revoke access; and
• provide information reasonably required for ScoreID to comply with its processor obligations and investigate misuse.

ScoreID will ensure that persons authorised to process Customer Personal Data are bound by statutory or contractual confidentiality, receive role-appropriate privacy, security and AI literacy training, and access data only as necessary. Access is reviewed and removed when no longer required.

Customer will apply equivalent confidentiality and training controls to personnel accessing the Services or Outputs, particularly personnel involved in underwriting, explanation, human review, model monitoring, rights handling and administrative access.

Taking account of the state of the art, implementation costs, nature, scope, context and purposes of processing, and risks to individuals, ScoreID will implement and maintain the measures in Annex 2. Measures may evolve where the overall protection is not materially reduced. ScoreID will test and evaluate effectiveness at intervals appropriate to risk and remediate material findings under a risk-based process.

Customer is responsible for security within its environment and integration, including secure API-key and token storage, least privilege, user lifecycle, endpoint and network security, webhook validation, environment separation, monitoring and timely patching. Customer will not require ScoreID to weaken security or transmit Customer Personal Data through an unapproved channel.

On request and subject to confidentiality, ScoreID will make available relevant security documentation and independent assurance reports, if available. Any certification is limited to its actual scope and period and is not a warranty that no incident can occur.

Customer grants general written authorisation for the Subprocessors listed in Annex 3 or the current Subprocessor List incorporated into the Agreement. Before production processing, the list must identify the legal entity, service, processing categories and primary locations. ScoreID remains responsible for each Subprocessor’s performance to the extent required by Applicable Data Protection Law.

ScoreID will impose written obligations that provide protection no less protective in substance than the Processor Module, including confidentiality, security, breach notice, rights assistance, deletion and transfer safeguards. ScoreID will conduct risk-proportionate diligence and periodically review material Subprocessors.

ScoreID will give at least thirty (30) days’ prior notice of a new Subprocessor where reasonably practicable. Customer may object within that period on reasonable and documented data-protection grounds. The Parties will seek a commercially reasonable alternative. If no solution is available, either Party may terminate the affected Service without penalty for the unused period. An objection is not valid where it is based solely on general preference and the proposed Subprocessor meets applicable requirements.

ScoreID will not make a Restricted Transfer of Customer Personal Data without an applicable mechanism. The Parties first rely on an adequacy decision where available. Otherwise, the SCCs are incorporated using the module that reflects the Parties’ roles, completed under Annex 4, together with the UK Addendum or Swiss adaptations where applicable.

ScoreID will assess the law and practice of the destination, document a transfer impact assessment where required and implement supplementary measures necessary to provide essentially equivalent protection. Measures may include encryption in transit and at rest, controlled key access, pseudonymisation, minimisation, access logging, transparency, challenge of disproportionate requests and data-location controls.

Customer will not direct a transfer or grant remote access from a destination without an approved mechanism and will provide information reasonably necessary for assessment. The SCCs prevail for a Restricted Transfer. A data subject may request a copy subject to protection of trade secrets, security and third-party rights.

Unless prohibited, ScoreID will notify Customer of a binding request for Customer Personal Data before disclosure, review the authority and scope, disclose only what is legally required and document the response. Where appropriate, ScoreID will challenge an unlawful or disproportionate request and seek confidentiality or other protective measures.

ScoreID will maintain a process for government access requests and provide aggregate transparency or relevant information where legally permitted. Customer is responsible for requests it receives and must not use ScoreID to circumvent applicable process or individual rights.

Taking account of the nature of processing, ScoreID will provide reasonable technical and organisational assistance for access, rectification, erasure, restriction, portability, objection, consent withdrawal, profiling and qualifying automated-decision requests. Assistance may include search, export, correction, status restriction, deletion and recipient information within available Service functionality.

If ScoreID receives a request concerning Customer Personal Data under the Processor Module, it will promptly notify Customer and will not respond substantively except on Customer instruction or where legally required. Customer remains responsible for determining the request and verifying identity, and for responding without undue delay and, for GDPR requests, within one month after receipt, subject only to a lawful extension notified within that first month. ScoreID will provide the assistance reasonably required to enable Customer to meet the applicable deadline without undue delay and, unless Customer reasonably specifies a shorter period, within ten (10) business days after receiving sufficient information and a documented instruction. ScoreID may charge reasonable fees for assistance beyond included functionality where permitted by the Agreement and law.

For an Output generated under ScoreID’s independent-controller role, ScoreID will handle rights concerning its own processing and coordinate with Customer where the request also concerns Customer’s decision. Neither Party will obstruct an individual from addressing the other controller directly.

ScoreID will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and, where reasonably practicable, provide an initial notice within twenty-four (24) hours. Failure to meet that target does not alter the statutory standard of without undue delay. The notice will describe known nature, affected data and persons, likely consequences, containment and contact information; information may be supplied in phases.

ScoreID will investigate, contain, remediate and preserve relevant evidence, provide information reasonably required for Customer’s Article 33–34 assessment, and cooperate with legally required notices. Notification is not an admission of fault. Customer is responsible for notifying authorities and individuals unless the Parties agree or law requires otherwise.

Customer will notify ScoreID without undue delay of an incident in Customer’s environment or misuse of Outputs that may affect the Services or individuals and will cooperate in coordinated response. Neither Party will issue a public statement naming the other without consultation, unless legally required.

ScoreID will provide information and reasonable assistance for Customer’s data-protection impact assessment, prior consultation, transfer assessment and, where applicable, AI Act fundamental-rights impact assessment, considering Score generation, systematic Profiling, combined financial/on-chain data, High-Impact Decisions and new technology. Customer remains responsible for its assessment and decision process.

ScoreID will make available relevant product and model information concerning intended purpose, input categories, principal logic, accuracy, limitations, human-oversight instructions, logs and incident reporting to the extent required by law and subject to confidentiality. Customer will not materially modify, relabel or change intended purpose in a manner that creates provider obligations without prior written approval and completion of required conformity measures.

If residual high risk cannot be mitigated, the Parties will not commence the affected processing until required prior consultation or other regulatory step is completed. Additional bespoke assistance may be chargeable where permitted.

ScoreID will maintain records required of a processor and make available information reasonably necessary to demonstrate compliance. Customer may first rely on current certifications, independent reports, security documentation and written responses. Subject to confidentiality and reasonable scope, Customer may conduct one audit per year on at least thirty days’ notice and additional audits following a material incident or regulator request.

An audit must use an independent qualified auditor, avoid access to other customers’ data, protect confidentiality, minimise disruption and not compromise security. Customer bears its audit costs unless a material breach by ScoreID is established. ScoreID may charge reasonable costs for duplicative or disproportionate audits.

Each Party will cooperate in good faith with competent supervisory authorities. ScoreID may audit Customer’s use of Scores, permissible-purpose records, user authorisations, human-review process and access controls where reasonably necessary to verify contractual or regulatory compliance.

Upon termination or expiration of the Processor Module, or upon Customer’s documented instruction, ScoreID will, at Customer’s choice, delete or return Customer Personal Data unless applicable law requires continued retention. Except where the instruction concerns a Data Subject request or another shorter legal deadline, active production copies will be deleted or irreversibly anonymised without undue delay and no later than thirty (30) calendar days after termination, expiration or the applicable instruction. Where the instruction concerns a Data Subject request, Section 12 applies and ScoreID will act within the shorter period required to enable Customer to meet the applicable statutory deadline. Backup copies will be isolated from ordinary use upon production deletion and overwritten through a documented cycle no later than ninety (90) days after production deletion. Backup copies will not be restored to ordinary use; if restoration is required for disaster recovery, the deletion instruction will be reapplied before the data become available for ordinary use.

ScoreID may retain only the minimum restricted records where continued storage is required by applicable law or is strictly necessary to establish, exercise or defend a specific legal claim. To preserve evidentiary value, the retained file may include the minimum identity data, transaction reference and audit metadata necessary to prove which person and transaction the record concerns. A general or hypothetical possibility of future litigation does not, by itself, justify continued retention. Retained records will be separated from active systems, access will be restricted, they will not be used for a new Score or decision, and they will be deleted when the applicable legal basis or hold ends. Customer is responsible for exporting required data before access ends.

Independent-controller records are retained under ScoreID’s Privacy Notice and applicable retention schedule. Termination of the Processor Module does not require ScoreID to erase data it lawfully controls for a distinct purpose, but ScoreID will not recharacterise instructed data solely to avoid deletion.

To the extent ScoreID acts as a processor, service provider or contractor under applicable U.S. state privacy law, ScoreID processes Personal Information only for the limited and specified business purposes in the Agreement; follows Customer instructions; provides the same level of privacy protection required by law; notifies Customer if it can no longer comply; and permits reasonable steps to stop and remediate unauthorised use.

ScoreID will not sell or share Customer Personal Information, use it for targeted advertising, retain/use/disclose it outside the direct business relationship except as permitted, or combine it with information from another source except to perform the specified purpose or as law permits. ScoreID will require equivalent terms from subcontractors and assist with consumer requests and data-protection assessments.

Customer may monitor compliance through the audit mechanisms in Section 15. Any FCRA, GLBA or other exemption is applied only to qualifying data or activity and does not broaden the permitted purpose.

This Addendum remains in force while ScoreID processes Personal Data under the Agreement. Liability is subject to the Agreement’s liability framework except where the SCCs or Applicable Data Protection Law prohibit limitation. Nothing limits direct rights of Data Subjects or authority powers.

The Addendum is governed by Netherlands law and the competent courts of Amsterdam have jurisdiction, subject to mandatory rights under the SCCs and Applicable Data Protection Law. Clauses concerning confidentiality, audit, deletion, transfer, liability and cooperation survive as necessary.

Before Customer Personal Data are processed in production, the Agreement or Legal Center must include a current named schedule. Generic vendor categories are not a substitute for the completed schedule.

• Module Two applies to controller-to-processor transfers; Module Three applies where Customer is processor and ScoreID is subprocessor, according to the factual roles.
• Clause 7 docking applies. Optional Clause 11 independent dispute resolution does not apply unless selected in the order form.
• For Clause 17, the law of the Netherlands applies. For Clause 18, the competent courts are those of the Netherlands.
• Annex I.A party details are the Agreement details; Annex I.B is Annex 1; Annex I.C identifies the competent authority under Clause 13; Annex II is Annex 2; Annex III is Annex 3.
• For Switzerland, references are adapted to the Swiss FADP and competent Swiss authority/courts as required. For UK transfers, the then-current UK Addendum is incorporated and completed from the Agreement details.
• If the SCCs are replaced, the successor clauses apply from the legally required date and the Parties will execute reasonable documentation needed to preserve lawful transfer.

• The recipient and Permitted Purpose must be identified before access. Access is limited to authorised personnel and the approved territory, product and period.
• The recipient establishes a lawful basis, provides Articles 13–14 notice, handles rights and satisfies sector-specific permissible-purpose or eligibility rules.
• Personal Data and Outputs must not be sold, used for advertising, reidentified, combined for unrelated surveillance or redistributed except where expressly authorised and lawful.
• The recipient checks Score status, freshness, data quality and model version and does not treat Historical, Expired, Disputed or Suspended Scores as current.
• For High-Impact Decisions, the recipient completes required assessments and provides meaningful human review, actual reasons, correction, contest and non-discrimination safeguards.
• The recipient reports material inaccuracy, misuse, breach, rights request or regulator inquiry relating to the shared data and cooperates in correction and notification.
• Each Party applies its own retention schedule and deletes or anonymises shared data when the purpose and legal retention need end.

This Annex applies only if expressly activated in the order form for a defined joint processing activity. The order form must describe the common purpose, essential means, data, persons, transparent essence and contact point.