Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the ForezynPlan Terms of Service (or, where applicable, a separately executed Master Services Agreement) between ForezynPlan Ltd ("ForezynPlan", "we", "us", or "Processor") and the business entity or individual ("Customer" or "Controller") that has accepted those terms.

This DPA applies wherever ForezynPlan processes Personal Data on behalf of the Customer in connection with the provision of the ForezynPlan financial planning platform and related services ("Services"). It sets out the rights and obligations of both parties with respect to the processing of Personal Data and is designed to satisfy the requirements of applicable data protection and privacy laws across all jurisdictions in which ForezynPlan or its Customers operate, including — without limitation — the EU GDPR, the UK GDPR, US state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA and others), Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act 1988, and Singapore's PDPA.

In the event of a conflict between this DPA and the Terms of Service, this DPA shall take precedence with respect to matters relating to Personal Data processing.

"Applicable Data Protection Law" means all applicable data protection, privacy, and security laws and regulations in any jurisdiction in which ForezynPlan or the Customer operates, including without limitation: the EU General Data Protection Regulation (EU GDPR 2016/679); the UK General Data Protection Regulation and the Data Protection Act 2018; Brazil's Lei Geral de Proteção de Dados (LGPD); Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws; Australia's Privacy Act 1988 (Cth); Singapore's Personal Data Protection Act (PDPA); and any successor or replacement legislation, in each case as amended from time to time.

United States. The United States does not currently have a single federal privacy law of general applicability. Instead, a growing number of US states have enacted comprehensive privacy statutes, all of which are included in "Applicable Data Protection Law" where they apply to the Customer's or a Data Subject's state of residence.

"Controller" means the Customer, being the natural or legal person who determines the purposes and means of the processing of Personal Data.

"Processor" means ForezynPlan Ltd, which processes Personal Data on behalf of the Controller.

"Personal Data", "Data Subject", "Processing", "Personal Data Breach", "Supervisory Authority", and "Special Categories of Personal Data" each have the meanings given to them in Applicable Data Protection Law.

"Services" means the ForezynPlan software platform and any ancillary services provided by ForezynPlan under the Terms of Service or Master Services Agreement.

"Sub-processor" means any third party engaged by ForezynPlan to process Personal Data on behalf of the Controller in connection with the Services.

"Standard Contractual Clauses" or "SCCs" means the standard data protection clauses for the transfer of Personal Data to third countries adopted by the European Commission pursuant to Article 46(2) of the EU GDPR, or the International Data Transfer Agreement (IDTA) or Addendum adopted for UK transfers, as applicable.

The Customer warrants and represents that: (a) it has a valid legal basis under Applicable Data Protection Law for providing Personal Data to ForezynPlan and instructing ForezynPlan to process it; (b) it has provided all necessary notices to, and obtained all necessary consents from, Data Subjects; and (c) it will comply with its obligations as a Controller under Applicable Data Protection Law.

The Customer agrees to ensure that its instructions to ForezynPlan comply with Applicable Data Protection Law and will not instruct ForezynPlan to process Personal Data in a manner that would cause ForezynPlan to violate any applicable law, regulation, or supervisory authority guidance.

The Customer is responsible for the accuracy, quality, and legality of the Personal Data it submits to the Services. ForezynPlan does not verify the lawfulness of the Personal Data provided by the Customer.

The Customer acknowledges that ForezynPlan is not responsible for determining whether the Services are appropriate for the Customer's specific legal obligations and that it is the Customer's responsibility to ensure the Services meet its data protection requirements before use.

ForezynPlan will only process Personal Data: (a) on documented instructions from the Customer, including as set out in this DPA and the Terms of Service; (b) as strictly necessary to provide, maintain, and support the Services; or (c) as required by applicable law, in which case ForezynPlan will (where legally permitted) notify the Customer before undertaking such processing.

ForezynPlan will ensure that all personnel authorised to process Personal Data are subject to appropriate obligations of confidentiality and have received training on data protection requirements.

ForezynPlan will provide the Customer with such information as is reasonably necessary to demonstrate compliance with the obligations of a Processor under Applicable Data Protection Law and will co-operate with audits and inspections as set out in Section 13 of this DPA.

ForezynPlan will not sell, rent, or otherwise disclose Personal Data to third parties for their own independent purposes. ForezynPlan will not process Personal Data for its own commercial benefit beyond what is necessary to provide the Services.

ForezynPlan will promptly notify the Customer if, in its reasonable opinion, an instruction from the Customer infringes Applicable Data Protection Law.

The Customer provides ForezynPlan with general written authorisation to engage Sub-processors as necessary to provide the Services. ForezynPlan's current list of approved Sub-processors is set out in the table below. ForezynPlan will provide the Customer with at least 30 days' prior written notice (by email to the account administrator) of any intended changes to this list, including the addition or replacement of Sub-processors. The Customer may object to any new Sub-processor in writing within 14 days of such notice on reasonable grounds. If the Customer objects and ForezynPlan cannot accommodate the objection without materially impacting the Services, ForezynPlan will notify the Customer and the Customer may terminate the relevant Services on 30 days' written notice without penalty.

ForezynPlan will enter into a written data processing agreement with each Sub-processor that imposes obligations at least equivalent to those imposed on ForezynPlan under this DPA. ForezynPlan remains liable to the Customer for the acts and omissions of its Sub-processors to the same extent as if ForezynPlan were performing the processing directly.

ForezynPlan will, taking into account the nature of the processing, provide the Customer with reasonable technical and organisational assistance to enable the Customer to fulfil its obligations to respond to Data Subject requests to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection.

If ForezynPlan receives a Data Subject request directly, ForezynPlan will promptly (and in any event within 5 business days) redirect the Data Subject to the Customer and will not respond to the Data Subject directly unless instructed to do so by the Customer or required by applicable law.

ForezynPlan offers the following self-service tools within the platform to assist Controllers in fulfilling Data Subject requests: (a) export of all Personal Data associated with a user account; (b) deletion of individual user accounts and associated data; (c) account audit log export for subject access requests. For data subject requests that cannot be fulfilled via self-service tools, the Customer should contact privacy@forezynplan.com with a detailed description of the request.

Where the Customer is required to carry out a Data Protection Impact Assessment (DPIA) or prior consultation with a Supervisory Authority under Articles 35 and 36 of the EU GDPR (or equivalent UK GDPR provisions) in connection with the Services, ForezynPlan will provide the Customer with reasonable assistance, including access to relevant information about ForezynPlan's processing activities and technical and organisational security measures.

ForezynPlan will notify the Customer as soon as practicable if it becomes aware that any instruction from the Customer would, in ForezynPlan's reasonable opinion, require the Customer to conduct a DPIA or is likely to result in a high risk to Data Subjects.

ForezynPlan stores and primarily processes Personal Data within the European Economic Area (EEA), using Microsoft Azure data centres in the EU West Europe and North Europe regions. ForezynPlan does not proactively transfer Personal Data outside the EEA or the UK without appropriate safeguards.

Where Personal Data is transferred to Sub-processors located outside the EEA or the UK (see Section 6), ForezynPlan ensures that such transfers are made on the basis of: (a) an adequacy decision by the European Commission or the UK Secretary of State; (b) Standard Contractual Clauses (EU SCCs — Commission Implementing Decision 2021/914 or the UK IDTA/Addendum, as applicable); or (c) another appropriate safeguard under Article 46 of the EU GDPR or UK GDPR.

By entering into this DPA, the Customer authorises ForezynPlan to make these transfers subject to the safeguards described above. Where SCCs are used, the Customer (as Controller) and ForezynPlan (as Processor) agree that the Module Two SCCs (Controller to Processor) are incorporated into this DPA by reference, with ForezynPlan acting as the data exporter and the relevant Sub-processor as the data importer, to the extent applicable.

ForezynPlan will promptly notify the Customer if it is required to suspend or terminate an international transfer mechanism and will co-operate in good faith to identify an alternative mechanism.

ForezynPlan will retain Personal Data for the duration of the Customer's subscription and for a further period of 30 days following termination or expiry of the subscription ("Retention Period"), during which the Customer may request an export of its data. After the Retention Period, ForezynPlan will securely delete or anonymise all Personal Data in its systems, including backups, subject to any overriding legal retention obligation.

Customers may configure custom data retention policies within the platform (e.g., extending or reducing the Retention Period) subject to ForezynPlan's minimum and maximum retention limits and any applicable regulatory requirements. Enterprise customers may negotiate bespoke retention terms.

ForezynPlan uses cryptographic erasure (key destruction) to delete data from encrypted storage, supplemented by logical deletion from application databases. Physical media containing Personal Data is decommissioned in accordance with NIST SP 800-88 guidelines.

On receipt of a written request from the Customer, ForezynPlan will issue a written confirmation of deletion within 30 days of completing the deletion process.

ForezynPlan will make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations of a Processor under Applicable Data Protection Law, and will allow for and contribute to audits and inspections conducted by the Customer or an auditor mandated by the Customer.

Before exercising any audit right, the Customer must: (a) provide at least 30 days' prior written notice; (b) ensure the audit is conducted during normal business hours; (c) use a qualified and independent auditor (not a competitor of ForezynPlan); and (d) ensure the auditor is bound by confidentiality obligations. Audits shall be limited in scope to matters directly relevant to ForezynPlan's compliance with this DPA and shall not unreasonably disrupt ForezynPlan's operations.

As an alternative to a direct audit, ForezynPlan may satisfy the Customer's audit requirements by providing: (a) its current SOC 2 Type II report; (b) its ISO 27001 certificate; and/or (c) responses to a Customer-provided security questionnaire. ForezynPlan will make its SOC 2 Type II report available to the Customer under a Non-Disclosure Agreement within 10 business days of a written request.

The Customer may conduct no more than one audit per calendar year, unless an audit is required by a Supervisory Authority or follows a confirmed Personal Data Breach attributable to ForezynPlan.

ForezynPlan's liability to the Customer for any breach of this DPA shall be subject to the limitations and exclusions set out in the Terms of Service (or Master Services Agreement), except that nothing in this DPA shall limit ForezynPlan's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be excluded by law.

Each party shall indemnify and hold harmless the other party from any losses, claims, damages, and regulatory fines arising from the indemnifying party's breach of its obligations under this DPA, subject always to the limitations set out in the Terms of Service.

Where a Supervisory Authority or court of competent jurisdiction holds both parties jointly and severally liable for a Personal Data Breach, the parties agree to allocate liability between themselves in proportion to their respective responsibility for the damage caused.