Data Processing Agreement

1. Parties and scope

1.1 This Data Processing Agreement ("DPA") is between the Customer (the "Controller") and KORALYZE FOR ARTIFICIAL INTELLIGENCE SERVICES - L.L.C, economic licence no. CN-6679007, Abu Dhabi, United Arab Emirates (the "Processor"). It forms part of the Koralyze Terms of Service.

1.2 This DPA applies when Koralyze processes personal data on the Customer's behalf to provide the Services. It does not apply where Koralyze acts as an independent controller, which is:

1. account, billing, security and website data;
2. use of Customer Content and Outputs for model improvement under section 7 of the Terms of Service, unless the Customer has opted out.
3. licensing of Outputs to third parties under section 13.2 of the Terms of Service, where the Customer has opted in.

1.3 Annex 1 describes the processing.

2. Customer obligations

The Customer:

1. determines the purposes of the processing and gives lawful instructions;
2. has a lawful basis for the processing, including a condition for any special category data such as appearance data used to recognise players;
3. provides privacy information to players and, for children, to parents or guardians, including information about Koralyze's model improvement use;
4. obtains any consent required, keeps records of it, gives Koralyze copies on request within 5 business days, manages opt-outs and withdrawals, and tells Koralyze which players must be excluded, as set out in section 5.2A of the Terms of Service;
5. carries out any data protection impact assessment needed for its use of the Services.

3. Processor obligations

Koralyze will:

1. process personal data only on the Customer's documented instructions, including these Terms and the Customer's use of the platform, unless the law requires otherwise. Koralyze will tell the Customer if it believes an instruction breaks the law;
2. make sure that every person authorised to process the data is bound by confidentiality;
3. apply the security measures in Annex 2;
4. use sub-processors only as set out in section 4;
5. help the Customer, as far as reasonably possible, to respond to requests from individuals to exercise their rights, including deleting a player's data from the Customer's library;
6. help the Customer meet its obligations on security, breach notification, impact assessments and consultation with regulators;
7. at the end of the Services, allow the Customer to export its data for 30 days, then delete all personal data processed for the Customer within 30 days after that export period, unless the law requires storage, or the data is held under the model improvement licence;
8. make available the information needed to show compliance with this DPA, and allow reasonable audits, on 30 days' notice, no more than once a year unless a breach has occurred.

4. Sub-processors

4.1 The Customer authorises the sub-processors listed in Annex 3.

4.2 Koralyze will give the Customer at least 30 days' notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Services with effect from the date the new sub-processor starts, without any termination fee.

4.3 Koralyze will bind each sub-processor to data protection terms that give at least the same protection as this DPA, and remains responsible for them.

5. Separation of customers

5.1 Koralyze stores each Customer's data, players and player identities separately.

5.2 Koralyze does not compare, match or link players or player identities across different Customers.

6. Personal data breaches

Koralyze will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice will describe the breach, the data and people affected, likely consequences, and the measures taken or proposed.

7. International transfers

7.1 Koralyze processes personal data in the United Arab Emirates and uses sub-processors in the locations in Annex 3.

7.2 EU and EEA transfers. For transfers from the EU or EEA, the parties agree to the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module 2 (controller to processor), which are incorporated into this DPA by reference, with these choices:

1. Clause 7 (docking clause) applies.
2. Clause 9: option 2 (general written authorisation of sub-processors), with the notice period in section 4.2.
3. Clause 11: the optional wording does not apply.
4. Clause 13: the competent supervisory authority is the authority of the EU Member State in which the data subjects whose data is transferred are located.
5. Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland.
6. Annex I of the SCCs is completed by Annex 1 and Annex 3 of this DPA. Annex II of the SCCs is completed by Annex 2 of this DPA.

7.3 UK transfers. For transfers from the UK, the parties agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 ("UK Addendum"), incorporated by reference. Table 1 is completed with the parties' details, Table 2 refers to the SCCs Module 2 as set out in section 7.2, Table 3 refers to Annexes 1 to 3 of this DPA, and in Table 4 neither party may end the UK Addendum when it changes.

7.4 Swiss transfers. For transfers from Switzerland, the SCCs apply as set out in section 7.2, with these changes: references to the GDPR include the Swiss Federal Act on Data Protection, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and data subjects in Switzerland may bring claims in Switzerland.

7.5 If there is a conflict between this DPA and the SCCs or the UK Addendum, the SCCs and the UK Addendum prevail.

8. Liability

Liability under this DPA is subject to the limits in the Terms of Service.

9. Term

This DPA lasts as long as Koralyze processes personal data for the Customer.

Annex 1: Description of processing

Annex 2: Security measures

1. Separate storage and access control for each Customer (tenant).
2. Encryption in transit (HTTPS) for the platform and file transfers.
3. Encryption at rest for the database (AES-256, Neon) and file storage (Tigris).
4. Time-limited signed links for file uploads and downloads.
5. Passwords stored as salted hashes; sign-in tokens expire after 7 days and are revoked on password change or deactivation.
6. Access to Customer data limited to Koralyze staff who need it, bound by confidentiality.
7. Processing machines: full-disk encryption, password-protected accounts, regular operating system updates. Only Koralyze staff use the processing machines.
8. Deletion of working files on processing machines within 30 days after processing, except copies held under the model improvement licence.
9. Backups: the database provider keeps point-in-time restore history for up to 30 days, depending on the plan.

Annex 3: Sub-processors

Koralyze's own processing machines are located in the United Arab Emirates.

Annex 4: Transfer clauses

The SCCs and the UK Addendum are incorporated by reference under section 7. Their texts are published by the European Commission (Commission Implementing Decision (EU) 2021/914) and the UK Information Commissioner (International Data Transfer Addendum, version B1.0). Koralyze provides a copy on request.