Data Processing Addendum

1.1 This Data Processing Addendum (the "DPA") forms part of the Merchant Terms of Service between Capay Global LLC ("Capay Global") and the Merchant, and governs the processing of personal data in connection with the Services. Where this DPA conflicts with the Merchant Terms of Service on the processing of personal data, this DPA prevails.

1.2 Capitalised terms not defined here have the meaning given in the Merchant Terms of Service. "Data-Protection Law" means each data-protection or privacy law applicable to the processing, including the Nigeria Data Protection Act 2023 and the NDPR, the Ghana Data Protection Act 2012, the Kenya Data Protection Act 2019, South Africa's POPIA, applicable Cameroon data-protection law, the laws of other operating countries, and, where applicable, the EU and UK GDPR.

1.3 "Personal Data", "processing", "controller", "processor", "data subject", "personal-data breach", and "supervisory authority" have the meanings given under applicable Data-Protection Law.

2.1 The parties acknowledge that their roles depend on the processing activity:

• For personal data the Merchant provides or makes available so that Capay Global can deliver the Services to the Merchant (for example the Merchant's customer and recipient data submitted with Transactions), the Merchant is the controller and Capay Global is a processor acting on the Merchant's documented instructions, except as stated below.
• For processing that Capay Global carries out to meet its own legal, regulatory, AML/CFT, Sanctions, fraud-prevention, risk, and record-keeping obligations, and to operate and secure the Services, Capay Global acts as an independent controller. Providers and licensed partners that execute Transactions may also act as independent controllers under their own obligations.
• Where Capay Global and the Merchant determine purposes and means jointly for a specific activity, the parties will agree the arrangement required by Data-Protection Law before that activity begins.

3.1 Where Capay Global acts as processor, it will process the Merchant's personal data only on the Merchant's documented instructions, including as set out in the Merchant Terms of Service, this DPA, and the Merchant's use of the Services, unless required otherwise by a law to which Capay Global is subject. Where such a law applies, Capay Global will inform the Merchant unless the law prohibits it.

3.2 Capay Global will inform the Merchant if, in its opinion, an instruction infringes Data-Protection Law, without obligation to provide legal advice.

4.1 The subject matter is the processing of personal data to provide the Services. The duration is the term of the Merchant Terms of Service plus any retention period required by law. The nature and purpose are the collection, storage, use, transmission, screening, and disclosure of personal data to operate payments, comply with law, prevent fraud, and support the Merchant.

4.2 Categories of data subject may include the Merchant's representatives and users, the Merchant's customers, payers, payees, and beneficial owners. Categories of personal data may include identity and KYC data, contact details, transaction and payment data, account and settlement data, device, IP, and location data, and communications. The Merchant must not submit special-category data through the Services except as strictly necessary and lawful; where it does, it warrants it has a lawful basis.

5.1 Where acting as processor, Capay Global will:

• Process personal data only as instructed and for the purposes of the Services.
• Ensure that persons authorised to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational security measures, as described in clause 8.
• Respect the conditions for engaging sub-processors set out in clause 6.
• Taking into account the nature of the processing, assist the Merchant by appropriate measures, so far as possible, to respond to data-subject requests under clause 7.
• Assist the Merchant with security, breach notification, data-protection impact assessments, and prior consultation, taking into account the information available to Capay Global.
• At the Merchant's choice, delete or return personal data at the end of the provision of the Services, and delete existing copies, unless retention is required by law (including AML record-keeping).
• Make available information reasonably necessary to demonstrate compliance with this clause, and allow for and contribute to audits under clause 9.

6.1 The Merchant provides a general authorisation for Capay Global to engage sub-processors to deliver the Services, including cloud and hosting providers, communications providers, KYC and sanctions-screening vendors, and, where they act as processors, payment Providers.

6.2 Capay Global maintains a list of sub-processors and will make it available on request or through the Platform. Capay Global will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for a sub-processor's performance of those obligations.

6.3 Capay Global will give the Merchant notice of an intended addition or replacement of a sub-processor and a reasonable opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a documented objection, the Merchant may terminate the affected Services as its remedy.

6.4 Some Providers and partners act as independent controllers rather than sub-processors; clause 2 governs those relationships.

7.1 Where Capay Global acts as processor, it will, taking into account the nature of the processing, assist the Merchant by appropriate technical and organisational measures, so far as possible, to fulfil the Merchant's obligation to respond to requests to exercise data-subject rights under Data-Protection Law.

7.2 If a data subject sends a request to Capay Global relating to processing carried out for the Merchant as controller, Capay Global will, unless legally required to act, direct the data subject to the Merchant or forward the request, and will not respond directly except to acknowledge receipt or as required by law. Where Capay Global is the controller for a processing activity, it responds under the Privacy Policy.

8.1 Each party will implement and maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, appropriate to the risk. Capay Global's measures include, as applicable:

• Encryption of personal data in transit and at rest where appropriate.
• Access controls, least-privilege access, and authentication for systems processing personal data.
• Network security, monitoring, logging, and vulnerability management.
• Segregation of environments, secure key management, and tokenisation of sensitive payment data where applicable.
• Organisational measures including staff confidentiality, security training, and incident-response procedures.
• Business-continuity and backup measures appropriate to the Services.

9.1 Capay Global will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting the Merchant's personal data processed by Capay Global as processor, and will provide information reasonably available to help the Merchant meet its own notification obligations. Notification is not an admission of fault.

9.2 Capay Global will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor it mandates, on reasonable prior notice, no more than once a year except where a supervisory authority requires or a breach warrants, subject to confidentiality and to not compromising the security or data of other customers. Capay Global may satisfy audit requests by providing third-party certifications or reports where available.

10.1 Personal data may be transferred to, or accessed from, countries other than the country of collection, including for hosting, support, screening, and Provider processing. Each party will ensure that a transfer of personal data across borders takes place only where a lawful transfer mechanism under applicable Data-Protection Law is in place.

10.2 Where a transfer is subject to a law that requires standard contractual clauses or an equivalent safeguard (including the EU and UK standard contractual clauses, or an approved local transfer instrument), the parties agree that the applicable clauses and safeguards apply to that transfer and are incorporated by reference, completed with the details in the schedules to this DPA.

10.3 Where required, the parties will complete a transfer risk assessment and apply supplementary measures. The specific transfer mechanism relied on for a given transfer, and any local registration or authorisation requirement (for example under the laws of Nigeria, Ghana, Kenya, South Africa, or Cameroon), will be identified in the schedules or notified to the Merchant for that transfer.

11.1 Capay Global retains personal data for as long as necessary for the purposes described in the Privacy Policy and this DPA, and for any period required by law, including AML/CFT record-keeping minimums (commonly at least five years after the end of the business relationship or the date of a Transaction, or longer where local law requires).

11.2 On expiry or termination, and at the Merchant's choice where Capay Global acts as processor, Capay Global will delete or return the Merchant's personal data and delete existing copies, except to the extent retention is required by law or the data has been aggregated or anonymised so it is no longer personal data.

12.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Merchant Terms of Service, to the extent permitted by Data-Protection Law.

12.2 If a provision of this DPA conflicts with a mandatory requirement of Data-Protection Law, that law prevails and the parties will negotiate in good faith to amend this DPA to comply. The schedules (categories of data, sub-processor list, security measures, and transfer clauses) form part of this DPA and are maintained by Capay Global; the current versions are available on request.

13.1 Data-protection contact and Data Protection Officer: [email protected]. Operational contact: [email protected]. Legal entity: Capay Global LLC, 10511 EastWind Way, Columbia, MD 21044, USA.

13.2 Related documents: the Merchant Terms of Service, the Acceptable Use Policy, the Privacy Policy, the Cookie Policy, and the AML/KYC Notice.