Data Processing Addendum

This Data Processing Addendum (the "Addendum" or "DPA") forms part of, and is incorporated into, the agreement between you and izzytap Portal ("izzytap", "we", "us" or "our") for the use of our software services. izzytap is an independent Software-as-a-Service provider based in Dubai, United Arab Emirates.

This Addendum applies whenever izzytap processes personal data relating to your End Clients, staff or contacts on your behalf in the course of providing the services. It records our respective obligations under applicable data-protection law and should be read together with our Privacy Policy, our Subprocessors list and the main Terms of Service. Where this Addendum conflicts with those documents on a data-protection matter, this Addendum prevails.

Capitalised terms not defined here have the meaning given in the Terms of Service.

• "Applicable Data Protection Law" means all data-protection and privacy laws that apply to the processing under this Addendum, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where relevant, the laws of a UAE free zone or any other jurisdiction whose law applies to you.
• "Personal Data" means any information relating to an identified or identifiable natural person that izzytap processes on your behalf under the agreement.
• "Data Subject" means the individual to whom Personal Data relates, principally your End Clients and their representatives.
• "Controller", "Processor", "processing" and "personal data breach" have the meanings given under Applicable Data Protection Law.
• "Subprocessor" means any third party engaged by izzytap to process Personal Data in connection with the services.

For Personal Data that izzytap processes to deliver the services to you, you are the Controller and izzytap is the Processor. You determine the purposes and means of that processing; izzytap processes it only to provide and support the services and on your documented instructions.

izzytap acts as an independent Controller only for its own account, authentication, billing and service-administration data, which it processes as described in our Privacy Policy. Where you are yourself a processor acting for another controller, references in this Addendum to your instructions include the instructions passed down through you.

The subject-matter of the processing is the provision of izzytap's software services to you. The processing lasts for the term of the agreement and for any wind-down period described in the section on return and deletion of data below.

The nature and purpose of the processing is the hosting, storage, organisation, retrieval, transmission and other handling of Personal Data as needed to operate the platform's business-setup, compliance and client-management features for you.

The categories of Data Subject and Personal Data are set out in Annex 1. In general, Data Subjects are your End Clients, their beneficial owners, signatories and representatives, and your own staff; Personal Data may include identity, contact, corporate-role, document and transactional information you choose to process through the platform.

izzytap will:

• process Personal Data only on your documented instructions, including as set out in the agreement and this Addendum, unless required to do otherwise by a law to which izzytap is subject, in which case izzytap will inform you unless that law prohibits it;
• ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations;
• implement and maintain the technical and organisational security measures described in the Security section and Annex 2;
• not sell Personal Data or use it for izzytap's own marketing or other independent purposes;
• promptly inform you if, in izzytap's opinion, an instruction infringes Applicable Data Protection Law, without any obligation to monitor the lawfulness of your instructions generally; and
• make available to you the information reasonably necessary to demonstrate compliance with this Addendum, as further described in the Audits and information section.

Taking into account the nature of the processing, izzytap will provide reasonable assistance through appropriate technical and organisational measures, so far as possible, to help you respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

If izzytap receives a request or complaint directly from a Data Subject relating to your Personal Data, it will not respond substantively but will forward it to you without undue delay so that you, as Controller, can handle it. izzytap will also provide reasonable assistance with data-protection impact assessments and prior consultations with a supervisory authority where these relate directly to izzytap's processing under this Addendum. izzytap may charge a reasonable fee for assistance that goes beyond the standard functionality of the platform.

izzytap will notify you without undue delay after becoming aware of a personal data breach affecting Personal Data processed on your behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate volume of data and Data Subjects affected, the likely consequences and the measures taken or proposed to address it.

izzytap will provide reasonable cooperation and information to help you meet your own notification obligations to supervisory authorities and Data Subjects. As Controller, you are responsible for determining whether a breach is notifiable and for making any required notifications. izzytap's notification is not, and should not be treated as, an acknowledgement of fault or liability.

You give izzytap general authorisation to engage Subprocessors to process Personal Data in connection with the services. Our current Subprocessors are listed on our Subprocessors page.

izzytap will impose data-protection obligations on each Subprocessor that are materially no less protective than those in this Addendum, and remains responsible to you for a Subprocessor's performance of those obligations. izzytap will give you reasonable notice of any intended addition or replacement of a Subprocessor, giving you the opportunity to object on reasonable data-protection grounds. If you raise a legitimate objection that cannot be resolved, your remedy is to terminate the affected part of the services in accordance with the Subscription & Billing Terms.

izzytap and its Subprocessors may process and store Personal Data in the United Arab Emirates and in other countries. Where izzytap transfers Personal Data to a country outside the jurisdiction whose law applies to your processing, it will ensure an appropriate transfer mechanism or safeguard recognised under Applicable Data Protection Law is in place, or that a permitted exemption applies.

You instruct and authorise izzytap to carry out such transfers as reasonably necessary to provide the services and to operate its Subprocessor arrangements as described on the Subprocessors page.

izzytap will implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, having regard to the state of the art, the costs of implementation and the nature, scope and purposes of the processing. A summary of these measures is set out in Annex 2 and includes tenant isolation between Firms, access controls, encryption in transit, logging and regular review.

On termination or expiry of the agreement, izzytap will, at your choice, delete or return the Personal Data it processes on your behalf, and delete existing copies, unless retention is required by a law to which izzytap is subject. Unless you request return within thirty (30) days after termination, izzytap may delete the Personal Data after that period.

During your subscription you can export data using the platform's available tools. Backup copies made in the ordinary course are overwritten or deleted on izzytap's routine backup cycle. Once deleted, Personal Data cannot be recovered.

izzytap will make available to you the information reasonably necessary to demonstrate compliance with this Addendum, ordinarily by providing its security documentation and any third-party certifications or reports it holds.

Where Applicable Data Protection Law gives you an audit right that these materials do not adequately satisfy, izzytap will allow an audit, limited to information and systems relevant to the processing of your Personal Data, on reasonable prior written notice, no more than once in any twelve-month period (unless required by a supervisory authority or following a personal data breach), during business hours, and subject to confidentiality. You will bear the costs of any such audit, and it must not compromise the security or confidentiality of other customers' data.

Each party's liability arising out of or related to this Addendum is subject to the limitations and exclusions of liability set out in the Terms of Service, and any reference in those terms to a party's liability applies to the aggregate liability under both the agreement and this Addendum together.

In the event of a conflict between this Addendum and the Terms of Service or any other part of the agreement, this Addendum prevails on matters of data protection. In all other respects the agreement remains in full force. This Addendum is governed by the laws of the United Arab Emirates, and the competent courts of the United Arab Emirates have jurisdiction over any dispute arising from it. Questions about this Addendum can be sent to hello@izzytap.com.

Annex 1 — Details of processing.

• Data Subjects: your End Clients and their beneficial owners, signatories and representatives, and your own staff and users.
• Categories of Personal Data: identity and contact details, corporate roles and ownership information, identification and supporting documents you upload, and service and transaction records generated through the platform.
• Special categories: not required by the platform; you should not upload special-category data unless strictly necessary and lawful.
• Nature and purpose: hosting and operating izzytap's business-setup, compliance and client-management tools for you.
• Duration: the term of the agreement plus the wind-down period described above.

Annex 2 — Security measures. Logical separation and tenant isolation of each Firm's data; role-based access controls and least-privilege administration; encryption of Personal Data in transit; authentication controls for user accounts; activity logging and monitoring; regular backups; vetting and confidentiality obligations for personnel; and periodic review of these measures. izzytap may update these measures over time provided the level of protection is not materially reduced.

Annex 3 — Subprocessors. The current list of authorised Subprocessors is maintained on our Subprocessors page and forms part of this Addendum.

This Addendum was last updated on 26 July 2026.