In this Agreement, unless otherwise stated herein, the following terms have the meanings ascribed to them:

• Controller: A natural or legal person, public authority, agency, or any other body which, alone or jointly with others, determines the purposes and means of processing of Personal Data.
• Processor: A natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.
• Sub-processor: Any other processor engaged by the Processor or by another Sub-processor to process Personal Data on behalf of the Controller.
• Personal Data: Any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
• Processing: Any operation performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, or any other form of making available, alignment or combination, restriction, erasure or destruction.
• Data Breach: A confirmed or suspected security incident resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to Personal Data.
• Data Subject: The identified or identifiable natural person to whom Personal Data relates.
• Standard Contractual Clauses (SCCs): The standard data protection clauses adopted by the European Commission for international data transfers.
• Supervisory Authority: An independent public authority vested with powers concerning data protection matters under applicable privacy legislation, the GDPR, or the Australian Privacy Act 1988.

2.1 Data Subject Categories

This Agreement applies to the processing of Personal Data of:

• Platform users (verified account holders)
• Employees and agents of users
• Contacts and business counterparties
• Ultimate Beneficial Owners (UBOs) and directors
• Website visitors and cookie subjects

2.2 Categories of Personal Data

The Processor shall process the following categories of Personal Data:

2.3 Purposes of Processing

• Provision of the MiningClawd platform and its features
• User authentication and account management
• Transaction processing and payment management
• Legal and compliance obligations
• Fraud detection and prevention
• Platform security and operations
• Customer support and communications
• Marketing and user research (consent-based only)

2.4 Duration of Processing

Processing shall continue for the duration of this Agreement unless otherwise specified under Article 11 (Term & Termination).

3.1 Process on Instructions Only

The Processor shall process Personal Data only on documented written instructions from the Controller. The Processor shall not use or disclose Personal Data for any other purpose unless explicitly required by law.

3.2 Personnel Confidentiality

The Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate legal obligation of confidentiality, subject to obligations equal to or more stringent than those contained in this Agreement.

3.3 Technical & Organizational Measures

The Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized processing, accidental damage or destruction, or loss, and in particular shall comply with the requirements detailed in Article 4.

3.4 International Transfer Compliance

Where processing involves transfer of Personal Data to jurisdictions outside Australia, the Processor shall comply with applicable international data protection laws, including execution of Standard Contractual Clauses.

3.5 Assistance with Data Subject Rights

The Processor shall, taking into account the nature of processing, assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to Data Subject requests, including access, rectification, erasure, portability, and restriction requests.

3.6 Data Deletion or Return

The Processor shall, at the choice of the Controller, delete or return all Personal Data after the termination of the provision of services, and delete existing copies unless applicable law requires storage of the Personal Data.

3.7 Audit Cooperation

The Processor shall cooperate with and be subject to audits by the Controller and shall provide information and documentation relating to the processing of Personal Data and security measures upon request.

4.1 Overview

The Processor shall implement the following technical and organizational measures appropriate to the risk level of the processing. A detailed list of measures is provided in Annex A.

4.2 Encryption

• Encryption in Transit: All data transmissions must be encrypted using HTTPS with TLS 1.3 or higher.
• Encryption at Rest: Sensitive Personal Data must be encrypted in databases using AES-256 encryption.
• End-to-End Encryption: Highly sensitive information (such as payment data) shall be encrypted at the application level.

4.3 Access Controls

• Role-Based Access Control (RBAC): Staff shall have only the minimum privileges necessary to perform their duties.
• Multi-Factor Authentication (MFA): MFA is mandatory for all administrative accounts and production environment access.
• Audit Logs: All data access must be logged in audited logs retained for at least 90 days.

4.4 Data Minimization

The Processor shall collect and retain only Personal Data that is necessary for the specific purposes of processing. No unnecessary data shall be collected.

4.5 Pseudonymization & Anonymization

Where feasible, the Processor shall pseudonymize Personal Data, particularly for testing, development, or analytical purposes.

4.6 Regular Testing

The Processor shall conduct penetration testing and vulnerability assessments at least quarterly and shall remediate any identified issues immediately.

4.7 Incident Management

The Processor shall maintain a Security Incident Response Plan including detection, escalation, notification, and recovery procedures.

4.8 Business Continuity

The Processor shall maintain disaster recovery and business continuity plans ensuring recovery of critical systems within 24 hours of any disruption.

5.1 Approved Sub-processors

The Processor is authorized to engage the following Sub-processors with prior authorization from the Controller. The current list of approved Sub-processors is provided in Annex B.

5.2 Sub-processor Change Procedure

Pre-engagement notification and objection procedure for new sub-processors: (a) 30 days' advance written notice to Controller, including sub-processor identity, location, processing scope and cross-border transfer safeguards; (b) Controller has 20 days to raise written objection on data protection grounds; (c) If Controller objects, MiningClawd shall: (i) not engage the sub-processor, OR (ii) suspend processing of affected data, OR (iii) Controller may terminate affected Services; (d) Current approved sub-processors listed in Annex B.

5.3 Delegation of Responsibility

The Processor shall ensure that Sub-processors are bound by written contract to provide the same or higher standards of data protection. The Processor remains fully liable for the performance of Sub-processors.

5.4 Customer Notification Rights

The Processor shall provide the Controller with a complete list of current Sub-processors and shall update this list upon request.

6.1 Primary Storage Location

All Personal Data shall be primarily stored in Australia (AWS ap-southeast-2 region, Sydney). This complies with Australian data localization requirements.

6.2 Transfer Mechanisms

Where data transfer to jurisdictions outside Australia is necessary, the Processor shall employ one of the following mechanisms:

• Adequacy decisions recognized by the European Commission
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules
• Explicit consent of Data Subjects

6.3 Transfer Impact Assessment

The Processor shall conduct a Transfer Impact Assessment evaluating the privacy legal framework and law enforcement environment of the destination country. The assessment shall be documented and provided to the Controller.

6.4 Enterprise Data Localization

For Enterprise customers requiring data localization, the Processor may store all data exclusively within Australian AWS regions with no international transfers.

7.1 Overview of Rights

The Processor shall assist the Controller in fulfilling the following Data Subject rights under privacy laws:

• Right of Access: Data Subjects have the right to access a copy of their Personal Data and information about how it is processed.
• Right to Rectification: Data Subjects have the right to correct inaccurate Personal Data.
• Right to Erasure (Right to be Forgotten): In certain cases, Data Subjects have the right to request deletion of their Personal Data.
• Right to Restrict Processing: Data Subjects have the right to restrict processing of their Personal Data.
• Right to Data Portability: Data Subjects have the right to receive their Personal Data in a structured, commonly-used, machine-readable format.
• Right to Object: Data Subjects have the right to object to processing.
• Protection Against Automated Decision-Making: Data Subjects have the right not to be subject to automated decision-making, particularly those involving profiling of personal aspects.

7.2 Response Timeline

The Processor shall assist the Controller to respond to Data Subject requests within 30 days of receipt, and may extend this period by up to two additional months where necessary.

7.3 Request Verification

The Processor shall require the Data Subject to provide proof of identity to verify the authenticity of the request. The Processor shall maintain records of requests and responses.

7.4 Technical Assistance

The Processor shall provide tools or features within its platform enabling Data Subjects to exercise their rights, including account export, data download, and deletion functions.

8.1 Notification Obligations

Upon becoming aware of or reasonably suspecting a Data Breach, the Processor shall notify the Controller without undue delay and in any case no later than 48 hours, in writing, providing the following details:

• The nature and scope of the breach
• The number and categories of affected Data Subjects
• Likely consequences
• Measures taken to mitigate the breach
• The Processor's contact point for further information

8.2 Authority Notification

The Processor shall assist the Controller in notifying any relevant Supervisory Authority within the timeline required by the authority, typically not exceeding 72 hours.

8.3 Investigation Cooperation

The Processor shall fully cooperate with any investigation by the Controller and shall provide relevant documentation and evidence upon request.

8.4 Remedial Measures

The Processor shall immediately take remedial measures to prevent further breaches or misuse and shall report all remedial steps to the Controller.

8.5 Notification Exemption

If a Data Breach is unlikely to pose a risk to the rights and freedoms of Data Subjects, the Processor may recommend exemption from direct Data Subject notification to the Controller, but the Controller retains final decision-making authority.

8.6 Notification Timeline

Upon discovery of a personal data breach affecting Controller's data: (a) Processor notifies Controller within 24 hours via info@lynaimining.com; (b) Notification includes: nature of breach, approximate number of data subjects/records affected, likely consequences and measures taken; (c) Processor cooperates with Controller's GDPR Article 33 notification within 72 hours; (d) Processor completes security review and remedial penetration test within 60 days of incident resolution.

9.1 Audit Scope & Procedures

Audit rights: (a) Remote audits: 2 per year (30-day notice); on-site audits: 1 per year (60-day notice); (b) Audits conducted during Processor's business hours, may be conducted remotely via video conference; (c) Processor bears internal staff cooperation time; Controller bears third-party auditor fees; (d) Auditor must sign NDA before access; (e) Processor may provide ISO 27001 or SOC 2 audit reports in lieu of direct audit; (f) Audit scope limited to processing activities related to Controller's data.

9.2 Audit Scope Details

Audits shall cover:

• Implementation and maintenance of technical and organizational security measures
• Personnel training and security awareness programs
• Data access logs and audit trails
• Incident response procedures and records
• Sub-processor compliance
• Processing of Data Subject requests

9.3 Third-Party Audit Reports

The Processor shall provide SOC 2 Type II audit reports (or equivalent international standards) upon request, certifying compliance with security measures. Reports shall be updated annually.

9.4 Cost Allocation

Routine audits (once per year) are borne by the Controller. Additional or more frequent audits are borne by the requesting party.

9.5 Audit Results Confidentiality

Audit results shall be treated as business confidential and used only for data protection and security improvement purposes. The Processor may request that sensitive sections of audit reports be subject to confidentiality restrictions.

10.1 Retention Periods

The Processor shall retain Personal Data only for as long as necessary to fulfill the purposes of processing. The following are retention period guidelines:

10.2 Deletion Procedures

Upon expiration of retention periods, the Processor shall:

• Securely delete all copies of Personal Data
• Purge data from backups (unless legally required to retain)
• Maintain evidence of deletion

10.3 Deletion Certificate

Upon request, the Processor shall provide a written certificate confirming deletion of Personal Data in accordance with this Article.

10.4 Legal Exceptions

If applicable law requires retention of Personal Data (e.g., tax law, litigation hold), the Processor shall notify the Controller immediately upon discovery of such obligation and shall continue to protect the data until the legal requirement is lifted.

11.1 Term of Agreement

This DPA becomes effective on the Effective Date and shall continue for the same duration as the Master Service Agreement (MSA) or subscription agreement. This DPA shall automatically renew or terminate with the MSA.

11.2 Data Upon Termination

Upon termination of this Agreement or the MSA, the Processor shall immediately:

• Cease processing of Personal Data
• Delete or return all Personal Data per the Controller's written instructions
• Provide the Controller with a deletion certificate

11.3 Transition Period

The Processor shall provide a transition period of up to 90 days for the Controller to retrieve its data or migrate to another processor. During this period, the Processor shall continue to comply with all terms of this DPA.

11.4 Survival Clauses

The following provisions shall survive termination of this Agreement:

• Confidentiality and security obligations
• Audit rights
• Liability and damages
• Governing law

12.1 Jurisdiction

This DPA shall be governed by the laws of the State of Victoria, Australia. In matters of data protection, this DPA shall be governed by:

• The Australian Privacy Act 1988 and its Australian Privacy Principles (APPs)
• Applicable national and local privacy laws
• The European Union's General Data Protection Regulation (GDPR) (where applicable)

12.2 Relationship to MSA

This DPA is an integral part of the MSA. In matters of data protection, this DPA shall prevail over any conflicting provisions in the MSA. For non-data protection matters, the terms of the MSA shall apply.

12.3 Conflict Resolution

Any conflict between this DPA and the MSA shall be resolved in the following order:

1. First, in matters of data protection, the terms of this DPA shall prevail
2. Second, applicable privacy laws (including GDPR and APPs) shall prevail
3. Third, other provisions of the MSA shall apply

12.4 Dispute Resolution

For any dispute arising from this DPA, the parties shall first attempt amicable resolution. If negotiation is unsuccessful within 30 days, either party may initiate litigation in the Victorian courts or other applicable jurisdiction.

This Annex details the technical and organizational security measures implemented by the Processor to protect Personal Data.

This Annex lists all approved Sub-processors processing Personal Data on behalf of the Controller. This list was last updated on February 1, 2026.