Data Processing Addendum

Effective date: April 19, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between The Useless Company PTE LTD (“Privocio”, “Processor”, or “we”) and the customer entity using Privocio as a controller or other responsible party (“Customer”).

This DPA applies where Privocio processes personal data on behalf of Customer in connection with the services.

1. Parties

Processor

Customer

The entity identified in the applicable order form, subscription, or service agreement.

2. Subject Matter and Duration

Privocio provides transcription and related services and may process personal data on Customer's behalf for the duration of the applicable service relationship, unless otherwise agreed.

3. Nature and Purpose of Processing

Processing may include receipt, transmission, temporary handling, analysis, transcription, formatting, support, security monitoring, and related technical operations necessary to provide the services.

4. Categories of Data Subjects

Depending on Customer use, data subjects may include:

• Customer personnel
• Customer end users
• Support contacts
• Business contacts
• Individuals whose audio or related data is lawfully submitted by Customer

5. Categories of Personal Data

Depending on Customer use, personal data may include:

• Contact and account details
• Technical identifiers and usage metadata
• Audio submitted for processing
• Transcription outputs
• Support and operational data

6. Customer Instructions

Privocio will process personal data only on documented instructions from Customer, unless otherwise required by applicable law.

7. Confidentiality

Privocio will ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations.

8. Security Measures

Privocio will implement reasonable technical and organizational measures designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure.

9. Subprocessors

Customer authorizes Privocio to engage subprocessors as reasonably necessary to provide the services, including hosting, infrastructure, support, analytics, payment, and security providers.

Privocio will remain responsible for subprocessors to the extent required by applicable law and contract.

10. Assistance

Taking into account the nature of processing and information available to Privocio, we will provide reasonable assistance to Customer in connection with data subject requests, security matters, and compliance obligations where required and appropriate.

11. Security Incidents

Privocio will notify Customer without undue delay after becoming aware of a confirmed security incident affecting Customer personal data, as required by applicable law or contract.

12. Deletion and Return

At the end of the service relationship, Privocio will delete or return Customer personal data in its possession as required by the applicable agreement, unless retention is required by law or necessary for security, dispute resolution, billing, or legitimate operational records.

13. Audits and Information

Where appropriate and subject to confidentiality, security, and practicality, Privocio will make available reasonable information necessary to demonstrate compliance with this DPA. Enterprise customers may negotiate more specific audit rights in a separate agreement.

14. International Transfers

Customer acknowledges that personal data may be processed in jurisdictions outside the Customer's own location depending on hosting, infrastructure, subprocessors, support operations, or customer-selected deployments. Where applicable, Privocio will take reasonable steps to implement appropriate protections.

15. Order of Precedence

If there is a conflict between this DPA and another written agreement between the parties regarding processing of personal data, the more specific data protection terms will control to the extent of the conflict.

16. Governing Law

Unless otherwise agreed in writing, this DPA is governed by the laws of Singapore.

17. Contact

Questions regarding this DPA may be sent to info@privocio.com.