DATA PROCESSING AGREEMENT.

Wavenure's single Data Processing Agreement («Wavenure DPA»), for Business Users who use Portfolio Gateway with their clients' data and for Cognitive Pro Business Customers.

How it applies.

• Portfolio Gateway. This Agreement is the DPA referred to in sections 2, 11.3 and 17.2 of the Portfolio Gateway Terms of Service and applies to Business Users only. It becomes part of the contract upon acceptance of the Terms and is also available on request at [email protected].
• Publication. This Agreement and the up-to-date list of Sub-processors are published in the Wavenure Legal Documents section at https://wavenure.com/legal.
• Cognitive Pro. From the effective date stated at the top, this Agreement is the «DPA Annex» (Allegato DPA) referred to in the General Terms and Conditions (EULA) and is signed together with them. Until then, DPA Annex version 1.5 remains in force for Cognitive Pro Business Customers, and the parts of this Agreement dedicated to Cognitive Pro are for information only.

• The Customer acting as controller («Controller»):
  • for Portfolio Gateway, the Business User who has accepted the Portfolio Gateway Terms of Service, as identified in their account and billing profile;
  • for Cognitive Pro, the Business Customer who has signed the General Terms and Conditions (EULA), as identified in Annex A;
• WAVENURE S.R.L., registered office at Via Dogana 3, 20123 Milano (MI), Italy, tax code and VAT number IT09355870966, REA no. MI-2085293, certified email (PEC) [email protected], acting as processor («Processor» or «Wavenure»).

(a) The Controller has entered into the Contract defined in section 1 with Wavenure.

(b) In performing the Contract, Wavenure may process personal data on the Controller's behalf.

(c) The parties wish to govern such processing in accordance with art. 28 GDPR, the Italian Privacy Code and the applicable measures of the European Data Protection Board and of the Italian Data Protection Authority.

1.1 Terms used in this Agreement have the meaning given in art. 4 of Regulation (EU) 2016/679 («GDPR») and, for capitalised terms not defined here, in the Contract.

1.2 In addition:

• Contract: the contract between the Controller and Wavenure for the Service, namely:
  • (a) for Portfolio Gateway, the Portfolio Gateway Terms of Service («pf-gateway Terms») together with the plan and price information shown at purchase;
  • (b) for Cognitive Pro, the General Terms and Conditions (EULA) with Annex A — Specific Conditions or Order Form.

References to individual sections of the Contract are collected in Annex 0;

• Service: the service Wavenure provides under the Contract: Portfolio Gateway or the Cognitive Pro Platform with the Modules activated;
• Applicable Law: the GDPR, Italian Legislative Decree 196/2003 (the «Italian Privacy Code») and the applicable measures of the Italian Data Protection Authority (Garante per la protezione dei dati personali);
• Controller Data: the personal data that the Controller uploads to or enters into the Service, or that the Service generates from it, as described in Annex 1;
• Data Subjects: the natural persons to whom Controller Data relates;
• Sub-processor: a third party to which the Processor entrusts, in whole or in part, the processing of Controller Data;
• Data Breach: a security breach as defined in art. 4(12) GDPR affecting Controller Data;
• Instructions: the Controller's documented instructions described in section 4;
• Polaris: the conversational assistant based on generative artificial intelligence models built into the Service («Polaris chat» in Portfolio Gateway, «Cognitive Polaris» in Cognitive Pro);
• Conversation Logs: the records of the questions asked to Polaris and of the answers received.

2.1 This Agreement covers Controller Data only. For data that Wavenure processes for its own purposes — contract management, invoicing, payments, proof of acceptance, security of the Service — Wavenure acts as an independent controller, under the privacy notice referred to in Annex 0. For Portfolio Gateway, this includes the account data of the Business User and of the people using the account on its behalf.

2.2 This Agreement applies only to Customers acting in the course of a business or profession. It does not apply to Portfolio Gateway Consumers: a Consumer who uploads data about themselves or their family members for purely personal or household activities is not subject to the GDPR for those activities (art. 2(2)(c) and recital 18 GDPR), and for that data Wavenure acts as controller under the Portfolio Gateway Privacy Notice. Cognitive Pro is reserved to Business Customers and is not offered to consumers.

2.3 The Controller warrants that:

• (a) it has a valid legal basis to process Controller Data and to entrust its processing to the Processor;
• (b) it has provided Data Subjects with the required information, including the use of service providers such as the Processor;
• (c) it uploads only the data needed for the purposes in section 3 and, where possible, identifies portfolios with codes rather than with the Data Subject's name;
• (d) it does not upload special categories of data (art. 9 GDPR) or data relating to criminal convictions and offences (art. 10 GDPR), unless agreed in advance in writing with the Processor;
• (e) its Instructions comply with Applicable Law.

3.1 Subject matter. The processing of Controller Data needed to provide the Service to the Controller.

3.2 Nature. Collection through file upload, data entry or API, recording, organisation, structuring, storage, consultation, use, alignment, processing to compute metrics and charts, processing through the artificial intelligence features, disclosure and making available to the Controller, erasure.

3.3 Purpose. Providing the Controller with the functions of the Service under the Contract and closely related activities: technical support requested by the Controller, security, backups and technical logs needed for performance, recording of Conversation Logs within the limits of section 7.

3.4 Duration. For the term of the Contract and until Controller Data is erased or returned under section 13.

3.5 A detailed description of the processing is set out in Annex 1.

4.1 The Processor processes Controller Data only on the Controller's documented Instructions, including with regard to transfers outside the European Economic Area, unless required to do so by Union or Member State law to which it is subject. In that case it informs the Controller before processing, unless the law prohibits it.

4.2 The Instructions consist of: the Contract, this Agreement, the Controller's use and configuration of the Service, and any further written instruction from the Controller accepted by the Processor. A further instruction involving costs or changes to the Service is agreed between the parties.

4.3 The Processor informs the Controller without undue delay if it considers that an instruction infringes Applicable Law, and may suspend its execution until the Controller confirms or amends it.

4.4 The Processor does not process Controller Data for its own purposes. In particular, it does not sell it, does not use it for marketing, and neither uses it nor allows it to be used to train artificial intelligence models, its own or third parties'. For Portfolio Gateway the artificial intelligence models are provided through Amazon Bedrock (Amazon Web Services), which does not use the data to train models and does not share it with the developer of the model; the model providers are listed in Annex 3. Section 7.3 also applies to Conversation Logs.

The Processor ensures that persons authorised to process Controller Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received appropriate training, and access it only as needed for their tasks.

6.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks for Data Subjects, the Processor implements the technical and organisational measures required by art. 32 GDPR, described in Annex 2. On the basis of this information, the Controller acknowledges that the measures are appropriate to the risk.

6.2 The Processor may update the measures to reflect technological developments and risks, provided that the overall level of protection is not reduced.

6.3 The Controller is responsible for the security of its credentials, its API keys and the user accounts it enables, under the Contract (Annex 0), and of any copies of Controller Data it downloads or exports from the Service, including reports shared with its clients.

7.1 The Controller instructs the Processor to record Conversation Logs for the following purposes:

• (a) providing the Service, including the Controller's access to its conversation history (in Portfolio Gateway the Controller can reopen conversations and delete them individually);
• (b) security and abuse prevention, including checking compliance with the usage limits set by the Contract (Annex 0);
• (c) technical support requested by the Controller and handling of reports about Polaris answers.

7.2 Conversation Logs are accessed only by the Processor's authorised staff, for the purposes in section 7.1. In Portfolio Gateway they are kept until the Controller deletes them; in any event they are deleted together with the other Controller Data under section 13.

7.3 No use for improvement or training. The Processor does not use Conversation Logs, not even in aggregated or anonymous form, to improve the Service or to train artificial intelligence models. Any different use requires an amendment to this Agreement under section 17.1.

7.4 To generate Polaris answers and other AI-generated content, the Processor sends the model providers listed in Annex 3 only the data needed for each request. The Controller avoids entering into conversations identifying data about its clients that is not needed for the question.

8.1 General authorisation. Pursuant to art. 28(2) GDPR, the Controller gives the Processor general authorisation to engage Sub-processors. The Sub-processors in use on the date of this Agreement are listed in Annex 3.

8.2 Up-to-date list. The up-to-date list of Sub-processors is published in the Wavenure Legal Documents section at https://wavenure.com/legal/subprocessors and is available on request at [email protected].

8.3 Changes. The Processor informs the Controller of any addition or replacement of Sub-processors at least thirty (30) days in advance, at the email address designated by the Controller under the Contract (Annex 0).

8.4 Objection. Within the notice period the Controller may object on documented and reasonable data protection grounds by writing to [email protected]. The parties seek a solution in good faith. Failing that, the Controller may terminate the parts of the Contract affected by the processing — for Portfolio Gateway, the subscription — with effect from the date the new Sub-processor starts, without prejudice to fees accrued up to that date. In that case the Processor refunds the part of the price paid for the unused period, calculated pro rata on the remaining days (for Portfolio Gateway, as also provided by section 14.3 of the pf-gateway Terms).

8.5 Same obligations. The Processor imposes on each Sub-processor, by contract or other legal act, the same data protection obligations as set out in this Agreement, in particular sufficient guarantees regarding security measures. The Processor remains liable to the Controller for the performance of the Sub-processors' obligations.

8.6 Urgency. If a Sub-processor must be replaced urgently for security or service continuity reasons, the Processor may proceed immediately and informs the Controller as soon as possible; the Controller retains the right to object under section 8.4.

9.1 The Processor hosts the Service and Controller Data on infrastructure located in the European Union, as listed in Annex 3 (for Portfolio Gateway: Amazon Web Services region eu-south-1, Milan, for the Service and the database, and eu-central-1, Frankfurt, for the artificial intelligence models).

9.2 The Processor transfers Controller Data outside the European Economic Area, or allows access to it from outside, only for the Sub-processor activities listed in Annex 3 and only if the transfer relies on one of the safeguards in Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the standard contractual clauses approved by the European Commission, with any supplementary measures.

9.3 Annex 3 states for each Sub-processor whether a transfer takes place and which safeguard it relies on. Any new transfer is notified to the Controller as provided in section 8.3.

10.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise Data Subject rights under arts. 15-22 GDPR.

10.2 The Service provides the Controller with tools to consult, update and erase Controller Data. In Portfolio Gateway the Controller can consult and delete portfolios, reports and conversations, update data with a new upload and download reports as PDF. To obtain Controller Data in a structured and commonly used format, and for anything it cannot do itself, the Controller writes to [email protected].

10.3 If a Data Subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not respond on the merits, unless otherwise instructed by the Controller.

11.1 The Processor notifies the Controller of any Data Breach without undue delay after becoming aware of it, and in any event within forty-eight (48) hours, at the email address designated by the Controller under the Contract (Annex 0).

11.2 The notification includes, as far as available at the time: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the contact point at the Processor ([email protected]), the likely consequences and the measures taken or proposed to address the breach and mitigate its effects. Information not immediately available is provided in phases without further undue delay.

11.3 The Processor provides all reasonable information and assistance to enable the Controller to meet its obligations to notify the supervisory authority (art. 33 GDPR) and communicate the breach to Data Subjects (art. 34 GDPR). Notification to the Controller is not an admission of liability.

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with the obligations in arts. 32-36 GDPR, including any data protection impact assessment and prior consultation of the supervisory authority, by providing the information it holds about the Service.

13.1 On termination of the Contract, or on a request to close the account sent to [email protected], the Processor deletes Controller Data within thirty (30) days. Within the same period the Controller may instead request the return of Controller Data in a commonly used format; return is followed by deletion. Retention obligations under Union or Member State law are reserved.

13.2 Before termination, the Controller can retrieve Controller Data with the tools in section 10.2, including downloading reports. The original uploaded files remain in the Controller's possession in any case.

13.3 Deletion extends to backup copies under the normal rotation cycles, within ninety (90) days (for Portfolio Gateway, within seven (7) days, the retention period of the automatic database backups). In the meantime, data in backups is not used for any other purpose.

13.4 At the Controller's request, the Processor confirms deletion in writing.

13.5 Data that Wavenure processes as independent controller (section 2.1), such as payment and billing data, falls outside this section and is kept for the periods stated in the privacy notice (ten years for accounting and tax records).

14.1 The Processor makes available to the Controller the information needed to demonstrate compliance with art. 28 GDPR.

14.2 Documentary checks first. The Controller accepts as evidence of compliance, in the first place: documentation of the measures, answers to reasonable and standardised security questionnaires, and current third-party certifications and audit reports of the Sub-processors, such as those of the infrastructure provider listed in Annex 3.

14.3 Direct audits. If that information is not sufficient, or if a supervisory authority requires it, the Controller may carry out an audit, directly or through a qualified, independent auditor bound by confidentiality and not a competitor of the Processor, no more than once a year except after a Data Breach or in cases of justified urgency, with at least thirty (30) days' written notice, during business hours, without hindering the Processor's operations or compromising the security and confidentiality of other customers' data, and where appropriate subject to a dedicated non-disclosure agreement.

14.4 The costs of the audit are borne by the Controller, unless significant breaches attributable to the Processor are found.

15.1 The parties' liability in connection with this Agreement is governed by the liability clauses of the Contract listed in Annex 0 — for Portfolio Gateway, sections 13.2 and 13.3 of the pf-gateway Terms; for Cognitive Pro, article 14 of the EULA — without prejudice to the mandatory provisions of arts. 82 et seq. GDPR on liability towards Data Subjects.

15.2 Any recourse claims between the parties are governed by art. 82(5) GDPR and by the same clauses of the Contract.

16.1 This Agreement takes effect on conclusion of the Contract — for Portfolio Gateway, on acceptance of the pf-gateway Terms; for Cognitive Pro, on signature — or, if later, on the effective date stated at the top, and ends with the Contract, but not before the Processor has deleted or returned Controller Data.

16.2 Obligations which by their nature must survive remain in force after termination, in particular confidentiality, return and deletion of data and, for the limitation period, the provision of information under section 14.

16.3 Existing Cognitive Pro contracts. For Cognitive Pro contracts signed before the effective date of this Agreement, DPA Annex version 1.5 (effective 4 June 2026) continues to apply until the Customer accepts this version, or until the first renewal following notice of the new version.

16.4 Each version of this Agreement states its version number and effective date at the top. Previous versions are kept and available on request at [email protected].

17.1 The Processor may amend this Agreement to align it with Applicable Law or the evolution of the Service, in the manner set out in the amendment clause of the Contract (Annex 0). Amendments cannot reduce the level of protection of Controller Data.

17.2 In case of conflict between this Agreement and the Contract or other contractual documents on the processing of Controller Data, this Agreement prevails, as also provided by the pf-gateway Terms (section 17.3) and the EULA (article 22.2).

17.3 Matters not governed by this Agreement are governed by the Contract and by Applicable Law.

17.4 Governing law and jurisdiction are as set out in the clauses of the Contract listed in Annex 0.

17.5 This Agreement is available in Italian and English; in case of discrepancy, the Italian version prevails.

Signature (only for Cognitive Pro Customers signing the Contract)

Place and date: ______________________________

The Controller (Business Customer): ______________________________

The Processor (WAVENURE S.R.L.): ______________________________

Portfolio Gateway: Terms of Service, version 1.0. Cognitive Pro: FINAL General Terms and Conditions (EULA) of 4 June 2026. If the numbering of either contract changes, only this table needs updating.

• Definitions — Portfolio Gateway — pf-gateway Terms: s. 2 — Cognitive Pro — EULA: art. 1
• Privacy roles, scope and reference to this Agreement — Portfolio Gateway — pf-gateway Terms: ss. 2 (definition of Wavenure DPA), 11.3 and 17.2 — Cognitive Pro — EULA: arts. 17.2 and 22.1(b)
• Privacy notice and cookie policy — Portfolio Gateway — pf-gateway Terms: ss. 2 (definition) and 3.1 — product notice at https://pf-gateway.wavenure.com/privacy; the Service does not use cookies — Cognitive Pro — EULA: arts. 17.1 and 17.6 (https://wavenure.com/privacy)
• Publication of this Agreement and of the list of Sub-processors — Portfolio Gateway — pf-gateway Terms: s. 2 (definitions of Wavenure DPA and of Wavenure Legal Documents), ss. 14.3 and 17.1 — https://wavenure.com/legal/dpa and https://wavenure.com/legal/subprocessors — Cognitive Pro — EULA: art. 19 (list set out in this Agreement)
• Credentials, API keys, attribution and security — Portfolio Gateway — pf-gateway Terms: ss. 3.3, 3.8 and 3.9 — Cognitive Pro — EULA: art. 8
• Email address for notices to the Controller — Portfolio Gateway — pf-gateway Terms: s. 3.7 (account email) — Cognitive Pro — EULA: art. 20 (address given at signature)
• Polaris usage limits — Portfolio Gateway — pf-gateway Terms: ss. 4.3 and 9 — Cognitive Pro — EULA: art. 7.7
• Polaris conversations and training — Portfolio Gateway — pf-gateway Terms: ss. 11.2 and 11.9 — Cognitive Pro — EULA: Annex A, section A.3, Cognitive Polaris, item vi
• Confidentiality of data — Portfolio Gateway — pf-gateway Terms: s. 11.4 — Cognitive Pro — EULA: art. 18
• Sub-contractors and AI providers; pro rata refund on termination following an objection — Portfolio Gateway — pf-gateway Terms: ss. 14.3 (including the refund), 11.8 and 7.3 — Cognitive Pro — EULA: art. 19
• Account closure, retention and deletion — Portfolio Gateway — pf-gateway Terms: ss. 7.4 and 11.5 — Cognitive Pro — EULA: art. 11.5 and section 13 of this Agreement
• Termination, cancellation and withdrawal — Portfolio Gateway — pf-gateway Terms: s. 7 (including 7.3 and 7.5) and s. 13.4 — Cognitive Pro — EULA: arts. 10 and 11
• Liability — Portfolio Gateway — pf-gateway Terms: ss. 13.2 and 13.3; for Business Users also 13.6, 13.7 and 13.8 — Cognitive Pro — EULA: arts. 14 and 15
• Amendments — Portfolio Gateway — pf-gateway Terms: s. 15 (in particular 15.2 and 15.4) — Cognitive Pro — EULA: art. 10.3
• Contract documents and precedence of this Agreement — Portfolio Gateway — pf-gateway Terms: ss. 17.2 and 17.3 — Cognitive Pro — EULA: arts. 22.1, 22.2 and 22.7
• Governing law and jurisdiction — Portfolio Gateway — pf-gateway Terms: ss. 16.1 and 16.3 (mediation: 16.4) — Cognitive Pro — EULA: art. 21
• Language — Portfolio Gateway — pf-gateway Terms: s. 17.1 — Cognitive Pro — EULA: art. 22.3

• Controller — Description: The Business User who has accepted the pf-gateway Terms
• Processor — Description: WAVENURE S.R.L.
• Categories of Data Subjects — Description: The Controller's current or prospective clients, and their family members or joint holders, whose portfolios the Controller uploads to the Service
• Categories of personal data — Description: Data identifying the Data Subject or making them identifiable, if entered by the Controller (e.g. portfolio name, descriptions, notes, file names); financial data: instruments held, ISIN codes, quantities, prices, values, dates of holdings and trades; derived data: metrics, charts, Analysis reports; Polaris chat Conversation Logs relating to the Data Subject
• Special categories (art. 9 GDPR) and criminal-offence data (art. 10 GDPR) — Description: Not envisaged. The Controller undertakes not to upload them (section 2.3(d); pf-gateway Terms, s. 9)
• Nature of the operations — Description: As in section 3.2
• Purpose — Description: As in sections 3.3 and 7.1
• Frequency — Description: Continuous, for the term of the Contract, according to the Controller's use of the Service
• Duration and retention — Description: For the term of the Contract; deletion within 30 days of the account-closure request or of termination; backups within 7 days; Conversation Logs as in section 7.2
• Place of processing — Description: European Union (AWS eu-south-1, Milan; artificial intelligence models on AWS eu-central-1, Frankfurt), and the locations of the Sub-processors listed in Annex 3

Taken from section 2 of DPA Annex version 1.5, with the addition of Conversation Logs.

• Controller — Description: The Business Customer who has signed the General Terms and Conditions (EULA)
• Processor — Description: WAVENURE S.R.L.
• Subject matter — Description: Processing of personal data needed to provide the Services described in Annex A to the Controller
• Categories of Data Subjects — Description: The Controller's users (end clients, employees, collaborators, business contacts)
• Categories of personal data — Description: Identification and contact data of the Controller's users; credentials; profile data; usage metadata; any data on model portfolios and configurations entered by the Controller; Cognitive Polaris Conversation Logs
• Special categories (art. 9 GDPR) and criminal-offence data (art. 10 GDPR) — Description: Not envisaged. The Controller undertakes not to enter them unless agreed in advance in writing
• Nature of the operations — Description: As in section 3.2
• Purpose — Description: Providing the Services configured by the Controller; technical support; security; backups; technical logging needed for performance; section 7.1
• Duration and retention — Description: For the term of the Contract; deletion or return under section 13
• Place of processing — Description: European Union (AWS eu-south-1, Milan) and the locations of the Sub-processors listed in Annex 3

The measures in this Annex apply to Portfolio Gateway. For Cognitive Pro, until the effective date of this Agreement stated at the top, the measures in Appendix 1 of DPA Annex version 1.5 apply.

A. Organisational measures

• Documented information security policy, reviewed periodically.
• Information security officer designated within Wavenure.
• Periodic training of authorised staff.
• Confidentiality agreements with employees and contractors (section 5).
• Documented management of changes, incidents and Data Breaches, with a procedure to detect, assess and notify them within the time limits of section 11 and a contact point at [email protected].
• Staff onboarding and offboarding procedures, with prompt revocation of access.

B. Technical measures

• Encryption of data in transit, with TLS 1.2 or higher, and at rest, with AES-256, including databases and backups.
• Databases not reachable from the Internet.
• Multi-factor authentication for all administrative access to the cloud infrastructure, including the root account.
• Separate test and production environments, with distinct machines and databases.
• Application logs and web server access logs kept for 90 days.
• Monitoring of system metrics and logs.
• Automatic daily encrypted database backups, kept for 7 days, with point-in-time recovery and deletion protection.
• Limits on request frequency for the Service and the API.

C. Infrastructure measures

• Data centres located in the European Union, with ISO/IEC 27001 or equivalent certification, at the infrastructure provider listed in Annex 3: eu-south-1, Milan, for the Service and the database, and eu-central-1, Frankfurt, for the artificial intelligence models.
• Physical access controls to the data centres, ensured by the infrastructure provider.

D. Measures for artificial intelligence systems and Polaris

• Review of the models and instructions used, checking of answers before introducing changes and handling of reports from Users.
• Recording of Conversation Logs only within the limits of section 7, with access restricted to authorised staff; no use of the Logs, not even in aggregated or anonymous form, to improve the Service or train models (section 7.3).
• No use of Controller Data to train artificial intelligence models (section 4.4).
• Only the data needed for each request is sent to the model provider: portfolio data and the text of the question, without account identifiers.
• No use of the data to train the provider's models and no retention by the provider: Amazon Bedrock does not retain prompts or answers, and model invocation logging is not enabled.

E. Measures specific to Portfolio Gateway

• Access through a personal account with email and password; email address verification at registration.
• Passwords stored only in non-reversible form (bcrypt).
• One API key per customer organisation, which the User can regenerate from the settings, making the previous one unusable.
• Logical separation of data: every read is bound to the account of the requester, and ownership of the portfolio is checked before any access to its data.

F. Providers

• Sub-processors selected on the basis of the guarantees they offer, under contracts compliant with art. 28 GDPR (section 8).

It covers Sub-processors that may process Controller Data. Providers that process only the Customer's account, payment and billing data, for which Wavenure is the controller (for Portfolio Gateway: Stripe for payments and Brevo for service emails), do not process Controller Data and are listed in the privacy notice. Cloudflare provides Portfolio Gateway only with domain name resolution (DNS): no data passes through it.

• Amazon Web Services EMEA SARL (Luxembourg) — Activity: Hosting of the Service, database and backups — Place of processing: EU (eu-south-1, Milan) — Transfer outside the EEA and safeguard: No
• Amazon Web Services EMEA SARL — Amazon Bedrock (Claude models developed by Anthropic, which has no access to the data) — Activity: Processing data to generate Analysis reports and Polaris chat answers — Place of processing: EU (eu-central-1, Frankfurt) — Transfer outside the EEA and safeguard: No
• Google Cloud Italy S.r.l. — Google Workspace — Activity: Wavenure mailboxes (support, privacy requests, administration): handling requests that may contain Controller Data — Place of processing: Google data centres in the EU and in other countries, including the United States — Transfer outside the EEA and safeguard: Yes, to Google LLC (United States): EU-U.S. Data Privacy Framework and standard contractual clauses

List in force for Cognitive Pro Business Customers under DPA Annex version 1.5. It will be updated on the effective date of this Agreement for Cognitive Pro.

• Amazon Web Services EMEA SARL — Activity: Infrastructure hosting — Place of processing: EU (eu-south-1, Milan) — Transfer outside the EEA and safeguard: No
• Amazon Web Services EMEA SARL — Activity: Managed database (RDS) — Place of processing: EU (eu-south-1, Milan) — Transfer outside the EEA and safeguard: No
• Google LLC — Google Workspace — Activity: Email service — Place of processing: EU — Transfer outside the EEA and safeguard: No
• ClickUp, LLC — Activity: Help desk and ticketing — Place of processing: USA — Transfer outside the EEA and safeguard: Yes — standard contractual clauses