Data Processing Agreement (DPA).

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)

Version 1.3 — 15 October 2026

This is a courtesy English translation of the Italian Data Processing Agreement. In case of any discrepancy, the Italian version prevails and governs the agreement.

This Agreement (the "DPA") is entered into between:

• the Customer of the Atropox service, as identified in its account, acting as controller (the "Controller"); and
• NoK Group S.r.l., with registered office at Via Cassia 1280, 00189 Rome (RM), Italy, tax code and VAT number 17725341006, share capital EUR 10,000.00 fully paid up, certified e-mail (PEC) nokgroup@legalmail.it, acting as processor (the "Processor").

The DPA forms an integral part of the Atropox Terms and Conditions of Service (the "Main Agreement") and is deemed accepted by the Controller upon acceptance of the latter. In Team Plans the Controller is the Organisation, and acceptance is given on its behalf by the Administrator who creates or manages the Network; in Individual Plans the Controller is the Customer, whether a natural or legal person, who enters or generates data relating to third parties in the Service.

Recitals

a) In using the Service, the Controller enters, uploads or generates personal data relating to third parties (including contacts, clients, project participants and subjects of intelligence reports), of which it determines the purposes and means of processing.

b) In order to provide the Service, the Processor processes such personal data on behalf of the Controller.

c) Article 28 GDPR requires such processing to be governed by a contract that binds the Processor to the Controller and sets out the minimum content required by law.

1. Definitions

Capitalised terms not defined in this DPA have the meaning given to them in the GDPR and in the Main Agreement.

2. Subject matter, nature, purpose and duration

2.1. The subject matter, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.

2.2. The duration of the processing is the same as that of the Main Agreement, without prejudice to obligations which by their nature survive termination.

3. Documented instructions of the Controller

3.1. The Processor processes personal data solely on the basis of the Controller's documented instructions, which consist of the Main Agreement, this DPA, the configurations and actions performed in the Service by the Controller and its Users (including specific requests to generate intelligence reports), and any further instructions given in writing.

3.2. The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions, unless it is legally prohibited from doing so.

3.3. The Controller warrants that it has an appropriate legal basis for the processing entrusted to the Processor and that it complies with its information obligations towards data subjects, with particular reference to Article 14 GDPR for data not obtained from the data subject, as is the case for intelligence reports. The Controller shall refrain from processing, through the Service, special categories of data (Article 9 GDPR) and data relating to criminal convictions and offences (Article 10 GDPR).

3.4. Standard instructions on searches concerning individuals. By accepting this DPA, the Controller gives the Processor the following instructions, which the Processor applies uniformly to all controllers: a) not to carry out searches on individuals (intelligence reports, profile completion, photo search, assistant searches) concerning minors; with regard to persons who hold or have held public functions — members of law enforcement, the armed forces, the judiciary or intelligence services — to carry out searches only within their public and professional dimension, excluding private address, family composition, habits and movements, vehicles, places frequented, operational duties and protective measures; b) to exclude from reports on natural persons any data relating to criminal convictions, offences and criminal proceedings, and any assessment of personal creditworthiness or solvency; c) to maintain and apply a list of persons who have objected to processing under Article 21 GDPR, carrying out none of the searches referred to in letter a) on them, regardless of the functions they hold; d) to automatically delete reports relating to natural persons 12 months after their generation; e) to record in each report the purpose and the declaration of use provided by the user; f) to retain for 12 months, on behalf of the Controller, the log of the actions of the artificial intelligence features, including the identifier of the analysed contact and the outcome of the safeguards.

4. Confidentiality

4.1. The Processor ensures that persons authorised to process the data are bound by an appropriate obligation of confidentiality and receive operational instructions pursuant to Article 29 GDPR.

5. Security measures (Article 32 GDPR)

5.1. The Processor adopts technical and organisational measures appropriate to the risk, described in Annex 2, and keeps them up to date in light of the state of the art.

6. Sub-processors

6.1. The Controller grants general authorisation for the engagement of the sub-processors listed in Annex 3.

6.2. The Processor shall inform the Controller, through the Service or other suitable means, of any intended addition or replacement of sub-processors, with at least 30 days' notice. The Controller may object on legitimate grounds within 15 days; failing agreement, the Controller may withdraw from the part of the Service concerned.

6.3. The Processor binds each sub-processor to data protection obligations equivalent to those of this DPA and remains liable to the Controller for their performance.

7. Assistance to the Controller

7.1. Taking into account the nature of the processing, the Processor assists the Controller, through appropriate technical and organisational measures, in responding to requests to exercise data subjects' rights (Articles 12-22 GDPR) and in fulfilling the obligations under Articles 32-36 GDPR (security, personal data breaches, data protection impact assessment, prior consultation). The Service provides the Controller with data export and deletion features that facilitate such assistance.

8. Personal data breaches

8.1. The Processor shall notify the Controller, without undue delay and in any event within 48 hours of becoming aware of it, of any personal data breach affecting the data processed on behalf of the Controller, providing the information referred to in Article 33(3) GDPR as soon as it becomes available and cooperating in containment, analysis and notification activities. It is understood that the obligations to notify the supervisory authority (Article 33 GDPR) and to communicate the breach to data subjects (Article 34 GDPR) lie with the Controller.

9. Transfers to third countries

9.1. The Processor does not transfer data outside the European Economic Area except on the basis of an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or another appropriate safeguard under Chapter V GDPR, together with any necessary supplementary measures. Transfers relating to sub-processors are set out in Annex 3.

10. Audits

10.1. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for and contributes to audits, including by means of documentary questionnaires and any certifications or third-party audit reports. On-site audits are permitted with at least 30 days' notice, no more than once a year save for just cause, at the Controller's expense unless a material non-compliance is found.

11. Return or deletion

11.1. Upon termination of the Main Agreement, at the Controller's choice, the Processor shall return or securely delete the personal data processed on its behalf, unless retention is required by law. The export and deletion features of the Service are suitable for implementing this clause.

11.2. During the relationship, intelligence reports relating to natural persons are automatically deleted 12 months after their generation, in accordance with the instruction in Article 3.4, letter d).

12. Term, governing law and jurisdiction

12.1. This DPA takes effect upon acceptance of the Main Agreement and terminates with it or when the processing ceases, if earlier. It is governed by Italian law. As to the competent court, Articles 20.3 (Individual Plans) and 28.1 (Team Plans) of the Terms apply, without prejudice to mandatory jurisdiction rules.

Annex 1 — Description of the processing

• Subject matter: processing of the personal data contained in the Customer Content, necessary to provide the Service.
• Nature and operations: collection, recording, organisation, structuring, storage, consultation, processing, retrieval, comparison, generation of analyses from public sources (intelligence reports), erasure.
• Purpose: to provide the Controller with the features of the Service it activates, including the management of contacts, clients, projects and activities, the conversational assistant (including by voice), the generation of intelligence reports, the completion of profiles with public data, the search for photos and logos, tag suggestions and the reading of uploaded documents, always upon request.
• Types of data: identification and contact data (name, e-mail, telephone, address, company, role, public profiles), notes and professional information, data relating to business relationships and, solely for intelligence reports, publicly sourced information relating to the analysed subject (professional and corporate data, findings from registers and open sources). Data under Article 9 GDPR and, for natural persons, under Article 10 GDPR are excluded.
• Categories of data subjects: contacts and representatives of the Controller, clients and prospective clients, project participants, subjects (natural persons) of intelligence reports.
• Duration: for the term of the Main Agreement; intelligence reports relating to natural persons for 12 months from their generation.

Annex 2 — Technical and organisational measures

• Logical isolation of data by Network and row-level access control (row-level security), with a default-deny policy.
• User authentication, with the option of two-step verification; server-side session validation.
• Encryption of data in transit (TLS) and at rest at the infrastructure providers; passwords stored in encrypted form at the authentication provider.
• Segregation of roles and least-privilege principle; no high-privilege keys in client-side code.
• Logs of relevant actions and security monitoring.
• Backup and resilience and recovery measures at the infrastructure providers, located in the European Union.
• Procedures for handling personal data breaches and for periodically assessing the effectiveness of the measures.

Annex 3 — Authorised sub-processors

Anthropic, PBC in turn engages its own sub-processors, including, for the web search feature, Brave Software, Inc. (United States), according to the list published by Anthropic, which imposes equivalent obligations on them pursuant to Article 28(4) GDPR.

Stripe Payments Europe, Limited processes payment data as an independent controller for the obligations applicable to it and otherwise as a processor; Google Ireland Limited processes authentication data as an independent controller. These entities do not process Customer Content on behalf of the Controller.