Data Processing Addendum

1. PARTIES AND SCOPE

This Data Processing Agreement ("DPA") forms part of the agreement governing the Customer's use of Qwotio (the "Main Agreement").

It is entered into between:

the Customer identified in Qwotio ("Controller");

and

Flowstox Ltd, company number 15865029, of 46 Nova Road, Croydon, England, CR0 2TL, United Kingdom ("Processor").

This DPA applies where Flowstox Ltd processes Personal Data on behalf of the Controller through Qwotio.

Where there is a conflict between this DPA and the Main Agreement regarding the processing of Personal Data, this DPA prevails to the extent of that conflict.

2. ROLES OF THE PARTIES

The Controller determines the purposes and essential means of processing Personal Data submitted to Qwotio by or on behalf of the Controller.

Flowstox Ltd processes such Personal Data on behalf of the Controller for the purpose of providing Qwotio.

Nothing in this DPA relieves either party of its own obligations under applicable data protection law.

3. SUBJECT MATTER AND DURATION

The subject matter of the processing is the provision, operation, maintenance and support of Qwotio and the processing necessary to provide quote-building, quote-request, customer communication and related functionality.

Processing continues for the duration of the Main Agreement and for any limited period afterwards during which Personal Data is retained in accordance with documented instructions, applicable retention requirements or legal obligations.

4. NATURE AND PURPOSE OF PROCESSING

Processing may include:

- collection; - recording; - organisation; - structuring; - storage; - retrieval; - consultation; - calculation and quote generation; - transmission where required to provide the service; - generation of customer-facing documents; - modification at the Controller's instruction; - deletion.

The purpose is to provide Qwotio functionality requested and configured by the Controller.

Flowstox Ltd will not use Customer Personal Data for independent advertising or marketing purposes.

5. CATEGORIES OF DATA SUBJECTS

Data subjects may include:

- prospective customers of the Controller; - customers of the Controller; - authorised users and representatives of the Controller; - other individuals whose ordinary Personal Data is lawfully submitted to Qwotio within the permitted scope of the service.

6. PERMITTED CATEGORIES OF PERSONAL DATA

Qwotio V1 is intended for ordinary Personal Data reasonably necessary for quotation and customer-request workflows.

Permitted data may include:

- first name; - last name; - email address; - telephone number; - event or service-request information; - event date and location; - quote answers; - product and service selections; - quantities; - pricing and quote totals; - customer notes that do not contain prohibited sensitive information; - technical information necessary for authentication, security and operation of the service.

7. PROHIBITED DATA

Unless Flowstox Ltd expressly agrees otherwise in writing and provides functionality specifically designed for such processing, the Controller must not use Qwotio to intentionally collect or process:

- racial or ethnic origin; - political opinions; - religious or philosophical beliefs; - trade union membership; - genetic data; - biometric data used for unique identification; - health or medical information; - allergies or food intolerances where they reveal health information; - information concerning a person's sex life; - sexual orientation; - criminal convictions; - criminal offences; - allegations of criminal offences; - related criminal security measures;

or other Personal Data subject to equivalent enhanced legal protections.

The Controller must not attempt to circumvent technical safeguards intended to prevent such processing.

If Flowstox Ltd reasonably identifies a configuration intended to collect prohibited data, Flowstox Ltd may prevent publication or use of that configuration until it is corrected.

8. CONTROLLER INSTRUCTIONS

The Controller instructs Flowstox Ltd to process Personal Data only as necessary to:

- provide Qwotio; - execute functionality configured by the Controller; - maintain security and integrity of the service; - provide support requested by the Controller; - comply with documented instructions provided through Qwotio or other recorded communications.

Flowstox Ltd will process Personal Data only on documented instructions from the Controller unless processing is required by applicable law.

Where legally permitted, Flowstox Ltd will inform the Controller before carrying out processing required by law that falls outside documented instructions.

If Flowstox Ltd reasonably considers that an instruction infringes applicable data protection law, it will inform the Controller.

9. CONTROLLER RESPONSIBILITIES

The Controller is responsible for:

- ensuring it has an appropriate lawful basis for its processing; - providing required privacy information to data subjects; - configuring Qwotio consistently with applicable law; - ensuring Personal Data submitted to Qwotio is adequate, relevant and limited to what is necessary; - ensuring authorised users use Qwotio appropriately; - not intentionally collecting prohibited data described in Section 7; - responding to data subjects as Controller, with assistance from Flowstox Ltd where required by this DPA.

10. CONFIDENTIALITY

Flowstox Ltd will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data will be limited to persons who require access for legitimate operational, security or support purposes.

11. SECURITY

Taking into account the nature of the processing, Flowstox Ltd will maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include, as applicable to Qwotio:

- authenticated access; - role-based and tenant-scoped access controls; - database row-level access controls; - logical tenant isolation; - secure transport; - protection of privileged credentials; - server-side enforcement of privileged operations; - audit/security controls; - secure development and testing practices; - backup and resilience measures provided through the underlying infrastructure; - mechanisms for revoking authorised access.

The current Technical and Organisational Measures are made available through Qwotio's Privacy & Data Protection area.

12. SUB-PROCESSORS

The Controller provides general written authorisation for Flowstox Ltd to engage sub-processors necessary to provide Qwotio.

Flowstox Ltd will:

- maintain an up-to-date list of relevant sub-processors; - impose equivalent Article 28 data-protection obligations on sub-processors; - remain responsible for its obligations under this DPA; - provide prior written notice of intended additions or replacements and a reasonable opportunity to object on legitimate data-protection grounds; - provide the Controller with a reasonable opportunity to raise legitimate data-protection objections.

The current Sub-processor List forms part of the privacy documentation available through Qwotio.

13. INTERNATIONAL DATA TRANSFERS

Flowstox Ltd will ensure that international transfers of Personal Data are made using a lawful transfer mechanism required by applicable data protection law.

Where an applicable adequacy decision permits the transfer, Flowstox Ltd may rely on that adequacy decision.

Where required, Flowstox Ltd or its relevant sub-processors will use appropriate contractual or other lawful safeguards.

14. DATA SUBJECT RIGHTS

Taking into account the nature of the processing, Flowstox Ltd will provide reasonable assistance to the Controller through appropriate technical and organisational measures to enable the Controller to respond to requests by data subjects exercising their applicable data-protection rights.

Flowstox Ltd will not independently determine the outcome of a data-subject request where it acts solely as Processor.

15. SECURITY INCIDENTS

Flowstox Ltd will notify the Controller without undue delay after becoming aware of a confirmed Personal Data Breach affecting Personal Data processed on behalf of the Controller where notification is required under applicable law.

Flowstox Ltd will provide reasonably available information necessary to assist the Controller with its applicable breach-notification obligations.

16. COMPLIANCE ASSISTANCE

Taking into account the nature of processing and the information available to Flowstox Ltd, Flowstox Ltd will provide reasonable assistance to the Controller with applicable obligations relating to:

- security of processing; - Personal Data Breach assessment and notification; - data protection impact assessments; - prior consultation with supervisory authorities where legally required.

17. RETURN AND DELETION

Following termination of the Main Agreement, and subject to applicable legal requirements and documented retention arrangements, Flowstox Ltd will, at the Controller's choice and where reasonably supported by the service:

- delete Personal Data processed on behalf of the Controller; or - make Personal Data available for return/export before deletion.

Existing copies will be deleted in accordance with applicable retention and backup lifecycle processes unless applicable law requires continued retention.

18. AUDIT AND INFORMATION

Flowstox Ltd will make available information reasonably necessary to demonstrate compliance with its obligations under Article 28 or equivalent applicable processor requirements.

Subject to appropriate confidentiality, security and proportionality safeguards, Flowstox Ltd will allow for and contribute to reasonable audits where required by applicable data protection law.

The parties should ordinarily seek to satisfy audit requirements first through available documentation, security information and written responses before requesting intrusive inspection.

19. SUB-PROCESSOR CHANGES

Where general authorisation is relied upon, Flowstox Ltd will maintain a mechanism through which the Controller can review the current Sub-processor List.

Where required by applicable law, the Controller may raise a reasonable objection based on legitimate data-protection grounds.

The parties will work in good faith to address the objection.

20. LIABILITY AND MANDATORY LAW

Nothing in this DPA limits rights or obligations that cannot lawfully be limited under applicable data protection law.

Any contractual allocation of liability under the Main Agreement applies subject to mandatory data-protection law.

21. CHANGES TO THIS DPA

Flowstox Ltd may update this DPA where reasonably necessary to reflect changes in law, regulation, Qwotio or its processing activities.

Material changes affecting the parties' data-protection rights or obligations may require acceptance of a new DPA version.

Minor administrative or non-material changes need not require re-acceptance where legally appropriate.

22. LANGUAGE

This DPA is available in English and Italian.

Both versions are intended to describe the same agreement.

In the event of inconsistency between the English and Italian versions, the English version prevails, subject to mandatory applicable law.

23. ELECTRONIC ACCEPTANCE

The parties agree that this DPA may be entered into electronically.

The individual accepting this DPA on behalf of the Controller confirms that they are authorised to bind the Controller to this DPA.

Electronic acceptance recorded by Qwotio constitutes the Controller's acceptance of this DPA.

Annex A — Processing details

Subject matter: Provision of Qwotio and customer quotation/request functionality.

Duration: Duration of the Main Agreement plus applicable deletion/retention lifecycle.

Nature: Collection, storage, organisation, retrieval, calculation, transmission, document generation and deletion as necessary to provide Qwotio.

Purpose: Providing the Qwotio service configured by the Controller.

Data subjects: Prospective customers, customers, authorised Business users and other individuals whose permitted ordinary Personal Data is submitted to Qwotio.

Permitted Personal Data: Contact information, event/service-request information, quote answers, selections, quantities, prices and other ordinary Personal Data necessary for quotation workflows.

Special Category Data: NOT PERMITTED in Qwotio V1. Criminal Offence Data: NOT PERMITTED in Qwotio V1.

Annex B — Technical and organisational measures

Account access uses Supabase authentication and verified Qwotio sessions. Email verification is required on untrusted devices; an enrolled trusted device requires a valid password and an unexpired device token. Trusted-device tokens are hashed in storage and can be revoked.

Authenticated application operations enforce live role and Business permissions on the server and in database functions. Application tables use row-level security and restricted direct grants. Business-bound relationships and reference checks enforce logical tenant isolation.

Privileged credentials are restricted to server-side code. Authentication cookies are HttpOnly, host-only and SameSite=Lax, with Secure enabled in production. Production authentication configuration requires HTTPS origins.

Security and consequential Business operations use the existing audit-event foundation. Support Run As access is explicit, time limited and audited. Account access and trusted devices can be revoked.

Published Quote Builder revisions and submitted commercial snapshots preserve the configuration used. Quote PDFs use a private Storage bucket, fixed Business/Quote paths, live authorization and integrity hashes; no public download URL is issued.

The repository contains targeted authorization, tenant-isolation, validation and server/client-boundary regression tests. These measures are not a certification or a guarantee that all vulnerabilities are prevented.

Annex C — Sub-processors

The direct providers used for Qwotio are listed below. Their own sub-processor lists are linked separately. The Controller grants general written authorisation for these providers. Flowstox will give prior written notice to the Business contact email of intended additions or replacements, with a reasonable opportunity to object on legitimate data-protection grounds. Equivalent Article 28 obligations must apply to sub-processors.

Provider use is verified from the application integrations and operating documentation. Actual processing regions and the transfer safeguards applicable to the Flowstox accounts require operational verification; no particular residency, adequacy decision or contractual transfer mechanism is asserted here.

Supabase — Supabase, Inc.

Service

Database, authentication and storage

Purpose

Storage and operation of account, Business, Builder, Request and customer information and private documents.

Data categories

Account identifiers, Business data, answers, contact details, quote records and private PDFs.

Processing locations / transfer safeguards

Pending operational verification; no specific location or transfer mechanism is asserted.

Status

In use

Vercel — Vercel Inc.

Service

Application hosting and server-side execution

Purpose

Delivery and execution of the Qwotio application.

Data categories

Application requests, contact details and answers transmitted through server operations, and technical connection metadata.

Processing locations / transfer safeguards

Pending operational verification; no specific location or transfer mechanism is asserted.

Status

In use

Resend — Plus Five Five, Inc.

Service

Transactional email

Purpose

Delivery of authentication and service communications, Request notifications and Quote emails.

Data categories

Recipient email addresses, names where used, message content, private Quote attachments and delivery metadata.

Processing locations / transfer safeguards

Pending operational verification; no specific location or transfer mechanism is asserted.

Status

In use