DATA CONTROLLER ("Controller" or "Customer"):

The entity identified in the subscription agreement or Terms of Use that determines the purposes and means of processing Personal Data through the Rexpt Platform.

DATA PROCESSOR ("Processor" or "Rexpt"):

Rexpt Corp., a Delaware corporation with registered offices at c/o Gust Delaware, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, Sussex County, United States.

Controller and Processor are each referred to as a "Party" and collectively as the "Parties."

This DPA is incorporated into and forms part of the Terms of Use or other master agreement (the "Principal Agreement") between Controller and Processor for the provision of Voice AI platform services (the "Services").

Table of Contents

1. Definitions

In this DPA, the following terms shall have the meanings set out below. Capitalized terms not defined herein shall have the meanings given to them in the Principal Agreement.

"Applicable Data Protection Law"

means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to: (a) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (b) the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"); (c) the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA"); and (d) any other applicable privacy or data protection laws.

"Controller"

means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

"Data Subject"

means an identified or identifiable natural person whose Personal Data is Processed.

"Data Subject Request"

means a request from a Data Subject to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, or objection.

"EEA"

means the European Economic Area, comprising the member states of the European Union plus Iceland, Liechtenstein, and Norway.

"Personal Data"

means any information relating to an identified or identifiable natural person that is Processed by Processor on behalf of Controller in connection with the Services.

"Personal Data Breach"

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed.

"Processing" or "Process"

means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

"Processor"

means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.

"Standard Contractual Clauses" or "SCCs"

means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission, as amended or replaced from time to time.

"Sub-processor"

means any third party engaged by Processor to Process Personal Data on behalf of Controller.

"Supervisory Authority"

means an independent public authority established by a member state pursuant to Article 51 of the GDPR, or any equivalent regulatory authority under Applicable Data Protection Law.

"Technical and Organizational Measures"

means the security measures implemented by Processor to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage.

2.1 Scope of Processing

This DPA applies to the Processing of Personal Data by Processor on behalf of Controller in connection with the provision of the Services under the Principal Agreement.

2.2 Roles of the Parties

The Parties acknowledge and agree that:

• Controller is the Data Controller with respect to Personal Data Processed under this DPA

• Processor is the Data Processor acting on behalf of Controller

• Processor shall Process Personal Data only on documented instructions from Controller, unless required to do so by applicable law

2.3 Controller Responsibilities

Controller is responsible for:

• Ensuring it has a lawful basis for Processing Personal Data and transferring it to Processor

• Providing all necessary notices and obtaining all necessary consents from Data Subjects

• Ensuring the accuracy of Personal Data provided to Processor

• Complying with all Applicable Data Protection Laws in its use of the Services

• Responding to Data Subject Requests (with Processor's assistance as required)

2.4 Details of Processing

3.1 Compliance with Instructions

Processor shall:

• Process Personal Data only on documented instructions from Controller, including with regard to transfers of Personal Data to a third country, unless required to Process by applicable law (in which case Processor shall inform Controller of that legal requirement before Processing, unless prohibited by law)

• Immediately inform Controller if, in Processor's opinion, an instruction infringes Applicable Data Protection Law

3.2 Confidentiality

Processor shall:

• Ensure that persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality

• Not disclose Personal Data to any third party except as permitted by this DPA or with Controller's prior written consent

3.3 Security Measures

Processor shall implement and maintain appropriate Technical and Organizational Measures to protect Personal Data, including:

• Encryption of Personal Data in transit using TLS 1.3 or equivalent

• Encryption of Personal Data at rest using AES-256 or equivalent

• Access controls ensuring only authorized personnel can access Personal Data

• Regular testing and evaluation of the effectiveness of security measures

4.1 Breach Notification

Processor shall notify Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Controller's Personal Data.

4.2 Breach Information

The notification shall include, to the extent known:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records concerned

• The name and contact details of Processor's data protection contact

• A description of the likely consequences of the Personal Data Breach

• A description of the measures taken or proposed to address the Personal Data Breach, including measures to mitigate possible adverse effects

4.3 Ongoing Obligations

Processor shall:

• Cooperate with Controller in investigating and remediating the Personal Data Breach

• Take reasonable steps to mitigate the effects and minimize any damage

• Provide additional information as it becomes available

• Not notify any Supervisory Authority or Data Subject on behalf of Controller unless expressly authorized in writing

5.1 Transfer Restrictions

Processor shall not transfer Personal Data to a country outside the EEA or the UK unless:

• The transfer is to a country deemed by the European Commission or UK Government (as applicable) to provide an adequate level of data protection

• Appropriate safeguards are in place, such as Standard Contractual Clauses, Binding Corporate Rules, or an approved certification mechanism

• A derogation under Article 49 of the GDPR applies

5.2 Standard Contractual Clauses

To the extent that Processing involves transfers of Personal Data from the EEA or UK to countries not recognized as providing adequate protection, the Parties agree that the Standard Contractual Clauses shall apply as follows:

• For transfers from the EEA: The EU SCCs (Commission Implementing Decision (EU) 2021/914) shall apply, with Processor as "data importer" and Controller as "data exporter," Module Two (Controller to Processor)

• For transfers from the UK: The UK International Data Transfer Addendum to the EU SCCs shall apply

• The details required by the SCCs are set forth in Schedule 4 (International Transfer Mechanisms)

5.3 Additional Safeguards

Processor shall implement supplementary measures as necessary to ensure that the level of protection of Personal Data is not undermined by the transfer, including:

• Technical measures such as encryption and pseudonymization

6.1 Audit Rights

Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and Applicable Data Protection Law, and allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller.

6.2 Audit Procedures

Audits shall be subject to the following conditions:

• Controller shall provide at least thirty (30) days' prior written notice of any audit

• Audits shall be conducted during Processor's normal business hours

• Audits shall not unreasonably interfere with Processor's business operations

• Audits shall be limited to once per twelve (12) month period, unless required by a Supervisory Authority or following a Personal Data Breach

• Controller shall bear all costs associated with the audit, including Processor's reasonable costs for staff time and resources

• Auditors must execute a confidentiality agreement acceptable to Processor

6.3 Third-Party Certifications

Processor may satisfy audit requirements by providing:

• SOC 2 Type II reports or equivalent third-party audit reports

• ISO 27001 certification or equivalent

7.1 Retention Period

Processor shall retain Personal Data only for as long as necessary to provide the Services and fulfill its obligations under the Principal Agreement, unless a longer retention period is required by applicable law.

7.2 Retention Schedule

The standard retention periods for Personal Data are:

• Call recordings: Ninety (90) days from call date

• Call transcripts: Ninety (90) days from call date

• Call metadata: Duration of the subscription plus ninety (90) days

• Account data: Duration of the subscription plus thirty (30) days

7.3 Deletion Upon Termination

Upon termination or expiration of the Principal Agreement, Processor shall, at Controller's election:

• Return all Personal Data to Controller in a commonly used, machine-readable format; and/or

• Delete all Personal Data and certify such deletion in writing

Controller must make its election within thirty (30) days of termination. If no election is made, Processor shall delete the Personal Data.

7.4 Exceptions to Deletion

Processor may retain Personal Data to the extent required by applicable law, provided that:

8.1 Term

This DPA shall remain in effect for the duration of the Principal Agreement and for as long as Processor Processes Personal Data on behalf of Controller.

8.2 Precedence

In the event of any conflict between this DPA and the Principal Agreement, this DPA shall prevail with respect to the Processing of Personal Data. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

8.3 Liability

Each Party's liability under this DPA shall be subject to the limitations and exclusions of liability set forth in the Principal Agreement, except that such limitations shall not apply to:

• Fines, penalties, or sanctions imposed by a Supervisory Authority directly attributable to a Party's breach of this DPA

• A Party's willful misconduct or gross negligence

• Claims by Data Subjects to the extent such limitation is prohibited by Applicable Data Protection Law

8.4 Indemnification

Each Party shall indemnify and hold harmless the other Party from and against any losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from:

• The indemnifying Party's breach of this DPA

• The indemnifying Party's violation of Applicable Data Protection Law

• Any claim by a Data Subject or Supervisory Authority resulting from the indemnifying Party's acts or omissions

Subject Matter

The provision of Voice AI platform services, including AI-powered telephone call handling, call recording, transcription, appointment booking, and related services.

Duration

For the duration of the Principal Agreement, plus any retention period required for data deletion.

Nature and Purpose

• Receiving and handling inbound telephone calls via AI Agent

• Recording and storing telephone conversations

• Transcribing telephone conversations

• Generating AI summaries and analysis of calls

• Processing appointment booking requests

• Sending SMS and email communications on behalf of Controller

• Integrating with Controller's third-party services (calendars, CRM, etc.)

• Providing analytics and reporting

• Maintaining and improving the Services

Categories of Data Subjects

• End Users: Individuals who call Controller's AI Agent (callers)

Access Control

• Role-based access control (RBAC) for all systems

• Unique user accounts with strong password requirements

• Multi-factor authentication for administrative access

• Principle of least privilege applied to all access rights

• Regular access reviews and prompt deprovisioning

• Maximum three (3) concurrent sessions per user account

Encryption

• TLS 1.3 encryption for all data in transit

• AES-256 encryption for all data at rest

• Encryption key management using cloud provider key management services

• Encrypted backups with separate key storage

Network Security

• Firewall protection with default-deny rules

• Intrusion detection and prevention systems

• DDoS protection via cloud provider services

Cloud Infrastructure Providers

Telephony and Communications

Business Services

Analytics and Monitoring

Transfer Mechanisms

For transfers of Personal Data from the EEA or UK to countries not recognized as providing adequate protection (including the United States), the following mechanisms apply:

1.1 EU Standard Contractual Clauses

The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference and shall apply to transfers from the EEA, with the following specifications:

• Module: Module Two (Controller to Processor)

• Clause 7 (Docking clause): Not applicable

• Clause 9 (Use of sub-processors): Option 2 (General written authorization)

• Clause 11 (Redress): Optional language not included

• Clause 17 (Governing law): Laws of Ireland

• Clause 18 (Choice of forum): Courts of Ireland

1.2 UK International Data Transfer Addendum

For transfers from the UK, the UK International Data Transfer Addendum to the EU SCCs (issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018) shall apply in addition to the EU SCCs.

2. Annex I to Standard Contractual Clauses

2.1 List of Parties