Introduction

This Data Processing Addendum ("DPA") is incorporated into and forms part of the applicable agreement, statement of work, service order, master services agreement, subscription agreement, project contract, or other written arrangement between Digital 2Moro Holdings LLC ("Digital 2Moro," "we," "us," or "our") and the customer, client, organization, or entity receiving Digital 2Moro services ("Customer").

This DPA governs the processing of personal data by Digital 2Moro on behalf of the Customer where Digital 2Moro acts as a processor, service provider, contractor, or similar role under applicable data protection laws. It is intended to define the rights and obligations of the parties when Digital 2Moro processes personal data in connection with the provision of websites, applications, mobile apps, AI systems, analytics solutions, automation workflows, cloud services, digital transformation projects, managed services, support services, and related technology offerings.

This DPA is designed to support compliance with applicable privacy and data protection laws, including where relevant, the General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy frameworks.

• This DPA applies when Digital 2Moro processes personal data on behalf of a Customer.
• This DPA supplements the applicable agreement between Digital 2Moro and the Customer.
• This DPA does not apply where Digital 2Moro processes data for its own independent business purposes.
• This DPA should be read together with the applicable agreement, service scope, and privacy-related documents.
• In the event of conflict, the terms of this DPA apply to the extent required for data processing matters.

For information about how Digital 2Moro processes personal data for its own business purposes, please review our Privacy Policy. For broader privacy and security commitments, please review our Data & Privacy and Security pages.

Definitions

For purposes of this DPA, the following definitions apply. Terms not defined in this DPA may have the meanings assigned to them under the applicable agreement or relevant data protection laws.

• Agreement: The applicable contract, statement of work, service order, master services agreement, subscription agreement, proposal, or written arrangement between Digital 2Moro and the Customer.
• Applicable Data Protection Laws: Privacy, data protection, cybersecurity, and electronic communications laws that apply to the processing of personal data under this DPA.
• Controller: The party that determines the purposes and means of processing personal data.
• Customer: The person, company, institution, organization, or legal entity that receives services from Digital 2Moro under the applicable Agreement.
• Customer Data: Data, content, records, materials, files, documents, databases, personal data, and other information provided by or on behalf of the Customer in connection with the services.
• Data Subject: An identified or identifiable individual whose personal data is processed under this DPA.
• Digital 2Moro: Digital 2Moro Holdings LLC, the service provider processing personal data as described in this DPA.
• Personal Data: Information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual.
• Processing: Any operation performed on personal data, including collection, recording, storage, organization, access, retrieval, use, disclosure, transmission, alteration, deletion, or destruction.
• Processor: A party that processes personal data on behalf of a controller and according to the controller's instructions.
• Security Incident: A confirmed or suspected event that compromises or may compromise the confidentiality, integrity, or availability of personal data processed under this DPA.
• Services: Websites, applications, platforms, mobile apps, software, AI solutions, automation workflows, consulting, support, managed services, and technology offerings provided by Digital 2Moro.
• Subprocessor: A third-party service provider engaged by Digital 2Moro to process personal data on behalf of the Customer in connection with the services.

Where terms such as "business," "service provider," "consumer," "sell," "share," or "personal information" are used in relation to the CCPA/CPRA, they have the meanings assigned under applicable California privacy law.

Scope & Applicability

This DPA applies only to the extent Digital 2Moro processes personal data on behalf of the Customer in connection with the services and where such processing is subject to applicable data protection laws. It does not apply to processing performed by Digital 2Moro for its own independent business purposes, such as account management, billing, marketing, security monitoring, legal compliance, internal administration, or relationship management, except where expressly stated otherwise.

The specific nature of the processing depends on the services purchased or requested by the Customer. For example, Digital 2Moro may process personal data when building a website with forms, developing a customer portal, integrating analytics, configuring a CRM, managing cloud infrastructure, supporting a learning platform, developing a mobile application, implementing AI-assisted workflows, or maintaining software systems on behalf of the Customer.

• Website design, development, hosting, maintenance, and support services.
• Web application, mobile application, and software development services.
• Customer portals, dashboards, marketplaces, booking systems, and learning platforms.
• AI, automation, analytics, business intelligence, and workflow solutions.
• Cloud configuration, infrastructure support, security hardening, and managed services.
• Digital marketing, SEO, content systems, lead generation, and analytics implementations.
• Support, troubleshooting, migration, optimization, and technical advisory services.

This DPA applies for the duration of the personal data processing activities performed by Digital 2Moro on behalf of the Customer, unless the parties agree otherwise in writing.

Roles of the Parties

The parties acknowledge that, for personal data processed under this DPA, the Customer generally acts as the controller and Digital 2Moro acts as the processor. Where the Customer acts as a processor on behalf of another controller, Digital 2Moro may act as a subprocessor.

The Customer determines the purposes and means of the processing, including what personal data is collected, why it is processed, how long it is retained, which individuals are involved, and what legal basis applies. Digital 2Moro processes personal data only in accordance with the Customer's documented instructions, the applicable Agreement, this DPA, and applicable law.

• Customer as Controller: The Customer determines the purpose and means of processing Customer personal data.
• Digital 2Moro as Processor: Digital 2Moro processes personal data on behalf of the Customer and according to documented instructions.
• Digital 2Moro as Subprocessor: Where the Customer acts as a processor, Digital 2Moro may process personal data as a subprocessor.
• Independent Processing: Digital 2Moro may act as an independent controller for its own business operations and legal obligations.
• Client-Owned Systems: The Customer remains responsible for privacy notices, lawful collection, consent, and end-user communications for client-owned systems.

The roles of the parties may vary depending on the specific service, project scope, legal framework, and processing activity involved.

Customer Responsibilities

The Customer is responsible for ensuring that its use of Digital 2Moro services and its instructions regarding the processing of personal data comply with applicable data protection laws, contractual obligations, industry requirements, and privacy notices provided to data subjects.

The Customer remains responsible for determining the purposes and means of processing, identifying the legal basis for processing, providing required notices, obtaining necessary consents, responding to data subject requests, and ensuring that personal data provided to Digital 2Moro has been collected and transferred lawfully.

• Provide lawful, complete, and documented processing instructions.
• Ensure that personal data has been collected and shared lawfully.
• Maintain appropriate privacy notices for users, customers, employees, applicants, and other data subjects.
• Obtain consents or establish other lawful bases where required.
• Limit personal data shared with Digital 2Moro to what is necessary for the agreed services.
• Ensure that the services are configured and used in accordance with applicable laws.
• Maintain responsibility for end-user communications, disclosures, and consent mechanisms.
• Review and approve project requirements involving personal data processing.
• Ensure that authorized users protect credentials, access rights, and administrative privileges.
• Notify Digital 2Moro of any special data handling requirements before processing begins.

The Customer should not instruct Digital 2Moro to process personal data in a manner that violates applicable data protection laws. If Digital 2Moro reasonably believes that a Customer instruction may violate applicable law or create material risk, Digital 2Moro may request clarification, refuse the instruction, suspend the affected processing, or take other appropriate action.

Customers are encouraged to review our Data & Privacy, Security, and Vendor & Technology Partners pages to better understand Digital 2Moro's privacy and security practices.

Digital 2Moro Responsibilities

Digital 2Moro will process personal data only as necessary to provide the services described in the applicable Agreement and in accordance with the Customer's documented instructions, this Data Processing Addendum, applicable laws, and industry-recognized security and privacy practices.

As a processor or service provider, Digital 2Moro is committed to implementing appropriate technical, administrative, and organizational measures designed to protect personal data against unauthorized access, accidental loss, unlawful disclosure, alteration, destruction, misuse, or other inappropriate processing activities.

Digital 2Moro continually evaluates its privacy, security, governance, and operational controls to support evolving business, regulatory, technological, and cybersecurity requirements.

• Process personal data only for authorized and documented purposes.
• Implement and maintain appropriate security safeguards.
• Restrict access to personal data based on legitimate business need.
• Support compliance with applicable privacy and data protection laws.
• Maintain reasonable confidentiality protections.
• Monitor systems and services for security threats and operational risks.
• Assist Customers in fulfilling applicable privacy obligations where required.
• Maintain governance processes supporting responsible data handling.
• Review and improve security and privacy controls on an ongoing basis.
• Use qualified personnel, vendors, and subprocessors to support service delivery.

Digital 2Moro's obligations under this DPA apply only to personal data processed on behalf of the Customer and do not limit Digital 2Moro's independent legal obligations, rights, or responsibilities under applicable law.

Processing Instructions

Digital 2Moro will process personal data only in accordance with documented instructions provided by the Customer unless otherwise required by applicable law. The applicable Agreement, statements of work, project documentation, service specifications, platform configurations, support requests, and written communications may collectively constitute documented processing instructions.

The Customer is responsible for ensuring that all instructions provided to Digital 2Moro are lawful, accurate, complete, and consistent with applicable privacy and data protection requirements.

Processing activities may include hosting, storage, organization, retrieval, transmission, analysis, configuration, migration, maintenance, support, backup, security monitoring, software development, troubleshooting, automation, analytics, AI-assisted processing, and other activities reasonably necessary to provide the contracted services.

• Personal data will be processed only for authorized service delivery purposes.
• Instructions may be provided through contractual documents and authorized communications.
• Digital 2Moro will not process personal data for unrelated purposes without authorization.
• Changes to processing requirements should be communicated in writing.
• Digital 2Moro may seek clarification when instructions are incomplete or ambiguous.
• Digital 2Moro may refuse instructions that appear unlawful or create unacceptable risk.
• Additional processing activities may require amendments to the applicable Agreement.

If Digital 2Moro becomes aware that a Customer instruction may violate applicable privacy, security, or data protection requirements, Digital 2Moro may notify the Customer and suspend the affected processing activity until the matter is resolved.

Confidentiality

Digital 2Moro recognizes that personal data and Customer information are often confidential in nature. All personal data processed under this DPA will be treated as confidential information and handled using appropriate safeguards designed to prevent unauthorized disclosure, misuse, or access.

Access to personal data is restricted to personnel, contractors, subprocessors, and authorized individuals who require access to perform legitimate service-related duties and who are subject to appropriate confidentiality obligations.

Confidentiality obligations continue even after personnel, contractors, or subprocessors cease providing services or no longer require access to the information.

• Protection of Customer information as confidential information.
• Access restricted to authorized personnel with legitimate business needs.
• Confidentiality obligations incorporated into employment or contractor arrangements.
• Protection of proprietary, sensitive, and personal information.
• Restrictions on unauthorized disclosure or sharing.
• Use of secure communication and collaboration practices.
• Ongoing awareness of confidentiality responsibilities.
• Appropriate handling of sensitive and regulated information.

Confidential information may only be disclosed where required by law, court order, regulatory obligation, or other legally binding requirement. Where legally permissible, Digital 2Moro may notify the Customer before making such disclosures.

Security of Processing

Digital 2Moro implements and maintains technical, administrative, and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse, or other security threats.

Security controls are designed using a risk-based approach that considers the nature of the processing, the sensitivity of the information involved, evolving cybersecurity threats, operational requirements, and industry-recognized security practices.

While no security program can eliminate all risk, Digital 2Moro seeks to maintain a defense-in-depth approach that incorporates multiple layers of protection across people, processes, technology, infrastructure, and vendor relationships.

• Role-based access controls and authorization mechanisms.
• Multi-factor authentication where appropriate.
• Encryption in transit using secure communication protocols.
• Platform-supported encryption capabilities for stored data.
• System monitoring, logging, and security event review.
• Secure software development and change management practices.
• Vulnerability identification and remediation processes.
• Infrastructure security controls and availability protections.
• Backup, recovery, and continuity planning capabilities.
• Vendor and third-party security assessments.
• Incident response and security escalation procedures.
• Periodic review and improvement of security controls.

Additional information regarding Digital 2Moro's security practices is available in our Security, Infrastructure Security, Product Security, and Governance & Operational Security pages.

Personnel & Access Controls

Digital 2Moro limits access to personal data based on business necessity, job responsibilities, operational requirements, and the principle of least privilege. Access rights are granted only to individuals who require access to perform authorized duties related to the services being provided.

Personnel access is managed through formal authorization processes, account management procedures, role-based permissions, authentication controls, and ongoing oversight mechanisms designed to reduce unauthorized access risks.

Access rights are reviewed periodically and may be modified, suspended, or revoked when business requirements, project assignments, security considerations, or employment status changes.

• Role-based access control frameworks.
• Least privilege access principles.
• Unique account authentication requirements.
• Multi-factor authentication where applicable.
• Access approval and authorization processes.
• Periodic review of access permissions.
• Timely revocation of unnecessary access.
• Logging and monitoring of privileged activities.
• Segregation of duties where appropriate.
• Security awareness and privacy training programs.
• Protection of credentials and authentication mechanisms.
• Management oversight of personnel access activities.

Digital 2Moro seeks to ensure that personnel who may access personal data understand their responsibilities regarding privacy, confidentiality, security, and compliance. Access to Customer data is restricted to the minimum level necessary to support service delivery and operational requirements.

Use of Subprocessors

Digital 2Moro may engage third-party service providers ("Subprocessors") to assist in delivering services, maintaining infrastructure, supporting operations, processing data, providing security capabilities, managing communications, enabling cloud services, supporting analytics, facilitating payment processing, delivering AI capabilities, or performing other activities necessary for service delivery.

The use of Subprocessors enables Digital 2Moro to provide scalable, reliable, secure, and efficient services. However, Digital 2Moro remains responsible for ensuring that Subprocessors are selected, managed, and monitored in a manner consistent with applicable privacy, security, and contractual obligations.

Before engaging a Subprocessor, Digital 2Moro evaluates the provider's security posture, privacy commitments, operational maturity, technical capabilities, reliability, and ability to support the requirements of the services being provided.

• Cloud hosting and infrastructure providers.
• Website hosting and content delivery providers.
• Data storage and database service providers.
• Analytics and reporting platforms.
• Communication and collaboration platforms.
• Customer support and ticketing systems.
• Payment processing providers.
• Security monitoring and threat detection services.
• Artificial intelligence and automation platforms.
• Backup, disaster recovery, and business continuity providers.

Digital 2Moro requires Subprocessors to implement appropriate security and confidentiality safeguards consistent with the nature of the services they provide. Where applicable, contractual protections are used to support compliance with privacy and data protection obligations.

Information regarding Digital 2Moro's vendor governance practices can be found on our Vendor & Technology Partners page.

International Data Transfers

Digital 2Moro operates in a globally connected technology ecosystem and may use infrastructure providers, cloud services, analytics platforms, security tools, communication systems, software providers, AI platforms, and Subprocessors located in multiple countries. As a result, personal data may be transferred to, processed in, accessed from, or stored in jurisdictions outside the country where the Customer or Data Subjects are located.

International transfers may occur as part of routine service delivery, cloud hosting arrangements, customer support activities, software maintenance, infrastructure management, backup operations, security monitoring, disaster recovery processes, and other legitimate operational functions.

• Use of globally distributed cloud infrastructure.
• Processing by authorized Subprocessors located in multiple jurisdictions.
• Support for international service delivery requirements.
• Cross-border backup and disaster recovery operations.
• Global collaboration and communication systems.
• Use of internationally operated technology platforms.
• International security monitoring and operational support activities.

Where required by applicable law, Digital 2Moro will implement reasonable safeguards designed to support the lawful transfer of personal data across borders. Such safeguards may include contractual commitments, vendor assessments, organizational controls, security measures, and other mechanisms appropriate to the processing activities involved.

Additional information regarding international data handling practices is available on our Data & Privacy page.

Assistance with Data Subject Requests

Depending on applicable privacy laws, Data Subjects may have rights relating to access, correction, deletion, portability, restriction, objection, consent withdrawal, and other forms of control over their personal data. As the controller, the Customer is generally responsible for receiving, evaluating, and responding to Data Subject requests.

Where Digital 2Moro processes personal data on behalf of a Customer, Digital 2Moro will provide reasonable assistance to help the Customer fulfill applicable obligations relating to Data Subject rights, taking into account the nature of the processing, the services provided, available technology, and the information available to Digital 2Moro.

If Digital 2Moro receives a request directly from a Data Subject relating to personal data processed on behalf of a Customer, Digital 2Moro may refer the request to the Customer unless prohibited by applicable law.

• Assistance with access requests.
• Support for correction and rectification requests.
• Assistance with deletion or erasure requests.
• Support for data portability obligations where applicable.
• Assistance with restriction and objection requests.
• Support for consent-related inquiries where relevant.
• Reasonable cooperation regarding privacy-related investigations.
• Provision of available information necessary to support Customer obligations.

Digital 2Moro may charge reasonable fees where extensive or extraordinary assistance is required beyond the scope of the services provided under the applicable Agreement.

Security Incident & Breach Notification

Digital 2Moro maintains incident response processes designed to identify, assess, contain, investigate, remediate, and recover from security incidents that may affect systems, services, infrastructure, operations, or personal data processed under this DPA.

If Digital 2Moro becomes aware of a confirmed Security Incident involving Customer personal data, Digital 2Moro will take reasonable steps to investigate the incident, mitigate potential impacts, restore affected services where appropriate, and provide relevant information to the Customer as required by applicable law and contractual obligations.

Notification timing may vary depending on the nature of the incident, the availability of reliable information, legal requirements, ongoing investigations, operational considerations, and the need to prevent further harm.

• Identification and escalation of potential security incidents.
• Investigation and assessment of affected systems and data.
• Containment and mitigation activities.
• Restoration of affected services where appropriate.
• Communication with affected Customers where required.
• Documentation of incident response activities.
• Post-incident review and corrective actions.
• Continuous improvement of incident response capabilities.

Notification of a Security Incident does not constitute an admission of fault, liability, wrongdoing, or legal responsibility by Digital 2Moro. Digital 2Moro will provide information that is reasonably available at the time of notification and may provide updates as additional information becomes available.

Additional information regarding Digital 2Moro's security program is available on our Security and Governance & Operational Security pages.

Data Retention, Return & Deletion

Digital 2Moro will retain Customer personal data only for as long as necessary to provide the services, comply with contractual obligations, support legitimate operational requirements, maintain security, investigate incidents, satisfy legal obligations, resolve disputes, or otherwise fulfill responsibilities under the applicable Agreement and this DPA.

Upon termination or expiration of the applicable Agreement, and subject to any legal, regulatory, contractual, operational, or security requirements, Digital 2Moro may return, export, archive, delete, anonymize, or securely dispose of Customer personal data in accordance with agreed procedures and applicable law.

Certain information may be retained for limited periods where necessary for business continuity, audit requirements, security monitoring, legal compliance, fraud prevention, dispute resolution, backup retention, or enforcement of contractual rights.

• Retention of data only as long as reasonably necessary.
• Support for Customer-directed return or export requests where applicable.
• Secure deletion or disposal of information when no longer required.
• Protection of archived or retained information.
• Management of backup and recovery retention requirements.
• Compliance with legal and regulatory retention obligations.
• Support for contractual offboarding and transition activities.
• Documentation of applicable retention and deletion processes.

Customers are responsible for retrieving or exporting any information they wish to retain before service termination where such retrieval capabilities are available. Digital 2Moro may not be able to recover deleted information once applicable retention periods have expired and deletion procedures have been completed.

Additional information regarding data retention practices is available in our Privacy Policy and Data & Privacy resources.

Audit Rights & Compliance Verification

Digital 2Moro recognizes that Customers may require assurance regarding the security, privacy, governance, and operational controls used to protect personal data processed under this Data Processing Addendum. Subject to reasonable limitations designed to protect security, confidentiality, intellectual property, and the rights of other customers, Digital 2Moro may provide information demonstrating compliance with its obligations under this DPA.

Digital 2Moro maintains documented policies, procedures, security controls, governance frameworks, operational practices, and privacy safeguards designed to support compliance with applicable legal, contractual, and industry requirements. Compliance evidence may be provided through documentation reviews, security summaries, questionnaires, certifications, attestations, policy reviews, or other reasonable mechanisms.

• Review of relevant privacy and security documentation.
• Assessment of applicable technical and organizational measures.
• Provision of reasonable compliance-related information.
• Review of security and governance practices where appropriate.
• Support for customer due diligence activities.
• Evaluation of operational security controls.
• Assessment of vendor and subprocessor management practices.
• Verification of applicable contractual obligations.

Any audit activity must be conducted in a manner that does not disrupt Digital 2Moro operations, compromise system security, expose confidential information belonging to other customers, create operational risk, or interfere with service delivery. Digital 2Moro may require reasonable advance notice, confidentiality commitments, scope limitations, and cost recovery for extensive audit requests.

Additional information regarding Digital 2Moro's governance, security, and compliance programs is available through our Trust Center.

Liability

Each party remains responsible for its own compliance with applicable privacy, data protection, cybersecurity, contractual, and regulatory obligations. Nothing in this DPA is intended to expand, reduce, or otherwise alter any liability limitations, indemnification obligations, remedies, exclusions, or responsibilities established under the applicable Agreement unless expressly agreed in writing.

The Customer remains responsible for determining the lawful basis for processing, providing required notices, obtaining necessary consents, responding to Data Subject requests, and ensuring that personal data is collected and shared lawfully. Digital 2Moro remains responsible for processing personal data in accordance with the Customer's documented instructions, applicable law, and the obligations described in this DPA.

• Each party remains responsible for its own legal obligations.
• Liability limitations in the applicable Agreement continue to apply.
• Nothing in this DPA creates unlimited liability unless required by law.
• Parties remain responsible for the actions of their employees and authorized representatives.
• Customers remain responsible for the legality of processing instructions.
• Digital 2Moro remains responsible for complying with processor obligations.
• Liability is subject to applicable laws and contractual limitations.

Where applicable privacy laws allocate responsibility between controllers, processors, businesses, service providers, contractors, or other regulated entities, the parties acknowledge that such legal obligations shall continue to apply in accordance with the relevant legal framework.

Term & Termination

This Data Processing Addendum becomes effective upon the commencement of personal data processing activities governed by the applicable Agreement and remains in effect for as long as Digital 2Moro processes personal data on behalf of the Customer.

This DPA automatically terminates when Digital 2Moro no longer processes personal data on behalf of the Customer, unless applicable legal obligations, contractual requirements, security considerations, retention obligations, dispute resolution requirements, or surviving provisions require continued effect.

• Effective upon commencement of applicable processing activities.
• Remains in effect throughout the duration of the services.
• Terminates when processing activities cease.
• Subject to applicable retention and legal requirements.
• Surviving provisions continue where legally or contractually required.
• May be superseded by updated versions or amended agreements.
• Supports orderly offboarding and transition activities.

Termination of this DPA does not relieve either party of obligations that by their nature are intended to survive termination, including obligations relating to confidentiality, security, liability, dispute resolution, data retention, legal compliance, and audit-related matters.

Governing Law

Unless otherwise required by applicable privacy laws or expressly agreed in writing between the parties, this Data Processing Addendum shall be governed by and interpreted in accordance with the governing law provisions specified in the applicable Agreement between Digital 2Moro and the Customer.

Where no governing law provision exists within the applicable Agreement, the parties may agree upon a governing jurisdiction through written contract, statement of work, master services agreement, service order, or other legally binding arrangement.

• Governed by the applicable Agreement where specified.
• Subject to mandatory privacy and data protection laws.
• Does not override non-waivable statutory rights.
• Supports interpretation consistent with applicable legal obligations.
• May be supplemented through written agreements between the parties.

Nothing in this DPA is intended to prevent compliance with applicable privacy, cybersecurity, regulatory, consumer protection, or other mandatory legal requirements.

Contact Information

Questions regarding this Data Processing Addendum, privacy obligations, data processing activities, security controls, audit requests, subprocessor management, international transfers, or other data protection matters may be directed to Digital 2Moro through our official communication channels.

Requests relating to data protection, privacy compliance, contractual processing obligations, or Customer inquiries may require verification and additional information before action can be taken.

• Privacy and data protection inquiries.
• Questions regarding processor obligations.
• Audit and compliance-related requests.
• Subprocessor and vendor-related inquiries.
• International transfer and security questions.
• Contractual data processing matters.

Digital 2Moro Holdings LLC
Tax ID: 2026-001875507
1309 Coffeen Avenue STE 1200
Sheridan, Wyoming 82801
United States

Additional information regarding Digital 2Moro's privacy, security, governance, and data protection practices can be found in our Trust Center, Data & Privacy, Security, Vendor & Technology Partners, and Privacy Policy.

Annex I – Details of Processing

This Annex describes the general categories of processing activities that may be performed by Digital 2Moro on behalf of Customers. Actual processing activities vary depending on the services purchased and the nature of the Customer engagement.

• Purpose of Processing: Delivery, operation, maintenance, support, improvement, and security of services.
• Categories of Data Subjects: Customer personnel, website visitors, application users, customers, students, patients, vendors, applicants, and other individuals whose data is provided by the Customer.
• Categories of Personal Data: Identity information, contact information, account information, transaction records, usage data, technical information, support records, content, and other Customer-provided data.
• Processing Activities: Collection, storage, hosting, retrieval, analysis, transmission, support, maintenance, backup, deletion, and other activities necessary for service delivery.
• Duration: For the period necessary to provide services and satisfy applicable retention requirements.

Annex II – Technical & Organizational Security Measures

Digital 2Moro maintains a risk-based security program designed to protect the confidentiality, integrity, availability, and resilience of personal data processed under this DPA.

• Role-based access controls.
• Multi-factor authentication.
• Unique account authentication.
• Encryption in transit.
• Secure hosting environments.
• Infrastructure monitoring and logging.
• Security awareness and training programs.
• Incident response procedures.
• Backup and disaster recovery capabilities.
• Vendor security assessment processes.
• Secure development lifecycle practices.
• Vulnerability management activities.
• Change management controls.
• Confidentiality obligations for personnel.
• Periodic review of security controls.

Additional details regarding Digital 2Moro's security controls are available throughout the Trust Center, including our Security, Product Security, Infrastructure Security, and Governance & Operational Security pages.

Annex III – Approved Subprocessors

Digital 2Moro may use carefully selected third-party providers to support the delivery, operation, security, hosting, monitoring, communication, analytics, AI capabilities, and maintenance of services. The list of approved Subprocessors may evolve as technologies, operational requirements, and business needs change.

Categories of approved Subprocessors may include:

• Cloud hosting and infrastructure providers.
• Website hosting and content delivery providers.
• Database and storage providers.
• Analytics and performance monitoring platforms.
• Communication and collaboration services.
• Customer support and ticketing systems.
• Payment processing providers.
• Security monitoring and threat detection platforms.
• Artificial intelligence and automation service providers.
• Backup and disaster recovery vendors.

Current Subprocessor information may be updated periodically and managed in accordance with Digital 2Moro's vendor governance and security assessment processes described in our Vendor & Technology Partners page.