Brenneck Pay - Data Processing Agreement (signed)

1. The Supplier processes personal data only to provide the Growth subscription and the implementation services described in the order form.
2. The data concerned is merchant and merchant-contact data held in the Customer's CRM, helpdesk, accounting system and related sources connected to the brain.
3. The Supplier processes personal data only on the Customer's documented instructions. The order form and this agreement are those instructions, together with any later written instruction from the Customer.

2. Location of processing and storage

1. Processing and storage of personal data take place only in the EU.
2. The brain runs in a Snowflake region located in the EU, inside the Customer's own Snowflake account. Data does not leave that account except as set out in this agreement.
3. No personal data is transferred to, or made accessible from, a country outside the EU, including for support, monitoring, backup or troubleshooting.
4. If the Supplier wishes to change any location, it must give the Customer prior written notice, and no change takes effect without the Customer's written approval.

3. Sub-processors

1. The Supplier engages only the sub-processors listed in the table below, each with the location in which it processes data.
2. Each sub-processor is bound by written terms that give the Customer the same protection as this agreement.
3. The Supplier remains responsible to the Customer for the acts of its sub-processors.

No other sub-processor is engaged at the date of signature. Any addition or replacement requires prior written notice and the Customer's written approval, and the Supplier will update the table with the new sub-processor's location.

4. Security measures

1. The Supplier maintains technical and organisational measures appropriate to the risk, including access controls, encryption and logging.
2. Access to the Customer's account by Supplier staff is limited to named staff who need it for the service.
3. The Supplier keeps access logs for activity in the brain and provides them to the Customer on request, as evidence, so that the Customer can verify the controls described here.

5. Confidentiality

The Supplier ensures that every person authorised to process personal data is bound by a duty of confidentiality that continues after their engagement ends.

6. Assistance and audit

1. The Supplier assists the Customer in responding to requests from data subjects and in meeting its obligations under the General Data Protection Regulation and the supervisory requirements that apply to the Customer as a payment institution.
2. The Supplier makes available the information needed to show compliance with this agreement and allows audits by the Customer or by its supervisor, including inspection of the processing locations listed above.
3. The Supplier will provide written evidence on request. A verbal assurance does not discharge any obligation under this agreement.

7. Personal data breaches

The Supplier notifies the Customer without undue delay after becoming aware of a personal data breach, and provides the information the Customer needs to meet its own notification duties.

8. Return and deletion

On termination or expiry of the subscription, the Supplier, at the Customer's choice, returns or deletes the personal data it holds and confirms the deletion in writing. Because the brain runs inside the Customer's own Snowflake account, the Customer retains control of its data throughout and at exit.

9. Term and precedence

1. This agreement applies for as long as the Supplier processes personal data for the Customer under the order form.
2. If this agreement conflicts with the order form or the master agreement on the processing of personal data, this agreement prevails.

Signatures

Signed on Tuesday 20 January 2026.

Information security acknowledgement for Brenneck Pay: Sabine Kranz, Information Security Officer, confirms that the EU-only condition of signature is met by sections 2 and 3 of this agreement.