PERSONAL DATA PROCESSING AGREEMENT

1. Parties and subject matter

1.1. This Personal Data Processing Agreement ("DPA") is entered into between QuantumData Strategy, Lda., tax identification No. 517874571, with registered office at Rua do Lago de Prata, n.º 16, C5, 2605-299 Belas, hereinafter "QDS" or the "Processor", and the customer organization identified in the commercial proposal or subscription to the QDS Routes platform, hereinafter the "Customer" or the "Controller".

1.2. The DPA forms part of the services contract and governs exclusively the processing of personal data by QDS on behalf of the Customer, in compliance with Article 28(2) to (4) of Regulation (EU) 2016/679 ("GDPR").

1.3. It does not cover processing in which QDS acts as an independent controller, in particular for commercial management, invoicing and the security of its own services, described in its Privacy Policy.

1.4. The description of the operations and data subjects is in Annex I; the sub-processors are listed in Annex II and the security measures in Annex III.

2. Obligations and instructions

2.1. The Customer determines the purposes and essential means of the processing. It is responsible for its lawfulness, for the information given to data subjects and for compliance with data protection rules and, where applicable, the Labor Code.

2.2. QDS processes personal data only on documented instructions from the Customer, including with regard to international transfers, unless required to do so by applicable law. In that case, it will inform the Customer in advance, unless prohibited by law.

2.3. The instructions include the contract, this DPA, the configurations made by authorized users and any additional written instructions accepted by QDS.

2.4. If it considers that an instruction infringes the GDPR or other data protection rules, QDS will immediately inform the Customer and may suspend its execution while the matter is assessed.

2.5. QDS will not sell the Customers' operational data, nor use it for its own advertising or to train AI models for independent purposes.

3. Confidentiality and security

3.1. QDS will ensure that its staff and other persons authorized to process data are bound by legal or contractual duties of confidentiality.

3.2. QDS will apply technical and organizational measures appropriate to the risk, under Article 32 of the GDPR, including protection of communications, access control, logical separation by organization and recovery and incident management mechanisms, as set out in Annex III.

3.3. The measures may evolve with technology, provided that they do not materially reduce the protection of the data processed on behalf of the Customer.

4. Sub-processors

4.1. The Customer grants general authorization for QDS to engage the sub-processors listed in Annex II, to the extent necessary to provide the service.

4.2. QDS will inform the Customer in writing of additions or replacements of sub-processors, as a rule 30 days in advance, allowing a reasoned objection on data protection grounds within 15 days. Urgent changes justified by security may be notified at shorter notice.

4.3. If the objection is well founded, the Parties will seek a proportionate alternative; if that is not possible, the Customer may terminate the affected services, with a proportionate adjustment of sums paid for services not provided.

4.4. QDS will impose on sub-processors data protection obligations substantially equivalent to those of this Agreement, under Article 28(4) of the GDPR, and remains liable to the Customer for their performance.

5. Data subject rights and cooperation

5.1. QDS will assist the Customer, by appropriate technical and organizational measures, in responding to requests for access, rectification, erasure, restriction, objection and portability, taking into account the nature of the processing and the information available to it.

5.2. Requests it receives directly concerning data processed on behalf of the Customer will be forwarded to the Customer without undue delay, unless a legal obligation provides otherwise.

5.3. QDS will provide the assistance reasonably necessary for compliance with Articles 32 to 36 of the GDPR, including impact assessments, security measures and prior consultation with the supervisory authority, to the extent required by Article 28(3)(f).

6. Incidents and data breaches

6.1. QDS will notify the Customer without undue delay after becoming aware of a personal data breach affecting the data entrusted by the Customer.

6.2. It will provide, as soon as available, the nature of the incident, the categories and approximate numbers of persons or records affected, the potential consequences, the containment measures and an operational contact, supplementing the information if necessary.

6.3. QDS will cooperate in the investigation and mitigation. The Customer, as controller, will determine the notifications to the authority and to data subjects that are required of it, without prejudice to QDS's own obligations.

7. Location and international transfers

7.1. The main infrastructure identified operates in the European Economic Area, at the locations described in Annex II. Physical location in the EEA does not, by itself, exclude the possibility of international transfers or access from third countries.

7.2. QDS will carry out international transfers only in accordance with the Customer's documented instructions and with Chapter V of the GDPR, using, as applicable, an adequacy decision, standard contractual clauses and appropriate supplementary measures.

7.3. QDS will provide information on recipients and applicable safeguards on request.

8. Geolocation and employment data

8.1. The Customer is responsible for verifying the lawfulness of the geolocation of vehicles or drivers, the provision of information to workers, the proportionality of the processing and the obligations under the Labor Code, including the prohibition on using remote surveillance means to monitor professional performance.

8.2. QDS will provide information on the functionalities, location categories, access profiles and privacy controls that it actually makes available, giving the assistance necessary for legally required impact assessments.

8.3. Technical functionalities do not give the Customer authorization for prohibited processing. QDS must not make available location collection in private mode or through alternative channels that neutralize the deactivation chosen by the worker, without a specific legal basis.

9. Audits and information

9.1. QDS will make available the information necessary to demonstrate compliance with Article 28 of the GDPR and will allow for and contribute to audits and inspections carried out by the Customer or an independent auditor mandated by it.

9.2. Except in justified urgent cases, audits will be scheduled with reasonable prior notice, respecting the security of the platform, confidentiality and the data of other customers. Reports, questionnaires and equivalent evidence may be used where appropriate, without prejudice to the right of audit.

9.3. The Parties will cooperate in remedying any non-compliance identified.

10. Retention, return and deletion

10.1. QDS will retain data on behalf of the Customer for as long as necessary to perform the contract, in accordance with documented instructions and legally imposed periods.

10.2. After the service ends, the Customer will choose between return and deletion of the personal data, under Article 28(3)(g) of the GDPR, unless retention is legally required.

10.3. QDS will make available the export or return means required by law, including those provided for in the Data Act where applicable, before final deletion.

10.4. Backups will be protected and deleted according to documented technical cycles, with no reuse for operational purposes, except for justified recovery subject to the applicable instructions.

10.5. Where the service falls within Chapter VI of Regulation (EU) 2023/2854 (Data Act), switching provider follows the periods in Article 25: notice not exceeding two months; transition completed within a maximum of 30 calendar days, without prejudice to the extension legally permitted; a data retrieval period of at least 30 calendar days. Once that period has expired, QDS deletes the Customer's exportable data and digital assets, unless retention is legally required. In all other cases, and unless the Customer instructs otherwise, QDS deletes the personal data processed on behalf of the Customer after the contract ends or the deletion instruction is given, within a reasonable period and in accordance with the technical cycles defined by QDS.

11. Liability and term

11.1. Each Party is liable for the obligations legally applicable to it. The DPA does not prejudice the rights of data subjects or the mandatory liability provided for in Articles 82 et seq. of the GDPR.

11.2. This Agreement enters into force upon contracting or the first provision of personal data to QDS, whichever occurs first, and remains in force for as long as QDS processes personal data on behalf of the Customer.

11.3. It is accepted by signing the individual contract or by a documented electronic mechanism of express acceptance. In the event of inconsistency with the Terms and Conditions, it prevails in the data protection matters it governs.

11.4. In the event of any discrepancy between language versions, the Portuguese version prevails, without prejudice to applicable mandatory rights. The English version is provided for ease of reading.

ANNEX I - DESCRIPTION OF PROCESSING

Subject matter and duration: hosting and processing, during the contract and the return/deletion phase, of the data necessary for the digital management of routes, vehicles, tasks and deliveries.

Purposes: itinerary optimization, organization of resources, allocation of deliveries, operational monitoring and provision of the functionalities actually contracted.

Operations: collection on behalf of the Customer, recording, organization, consultation, storage, calculation, updating, communication to authorized users, export and deletion.

Data subjects: the Customer's employees and drivers; delivery recipients; professional contacts and other persons identified in operational records.

Data: names and professional contact details; addresses and delivery instructions; schedules and statuses; identification of vehicles and drivers; routes, profiles and operational records; where actually activated, GPS, photographs and proof-of-delivery metadata; content of requests to the AI assistant.

Special categories: the service is not intended for the systematic processing of the data referred to in Article 9 of the GDPR; its use for that purpose requires specific assessment and agreement.

ANNEX II - SUB-PROCESSORS

Hetzner Online GmbH - hosting of QDS's main infrastructure and associated services; servers in Helsinki, Finland.

Amazon Web Services - Cognito authentication, SES email sending, S3 storage, RDS database replica for disaster recovery, CloudFront content delivery (map server, status page and maintenance page) and, when the assistant is enabled, Amazon Bedrock; infrastructure identified in the Ireland region (eu-west-1); processing in Amazon Bedrock uses a European Union inference profile and may take place in other EU regions. CloudFront points of presence include North America.

ANNEX III - TECHNICAL AND ORGANIZATIONAL MEASURES

A. Access control by user and role, application of the principle of least privilege, mandatory multi-factor authentication (TOTP) and credential management.

B. Logical separation of the data of the different customer organizations (isolation by organization at database level in the applicable tables) and appropriate authorization controls.

C. Communications: public access protected by TLS; traffic between infrastructure components protected by encrypted channels. Encryption at rest in storage components and backups, and additional application-level encryption of selected personal data, with controlled key management.

D. Incident logging and response; updates and vulnerability management; rate limiting, protection against malicious IP addresses and security monitoring.

E. Backups, continuity and recovery, with documented policies on access, rotation and deletion.

F. Confidentiality of staff and providers and appropriate contracts with sub-processors.

G. Periodic review of the measures in light of risks and technological changes.

Backups are retained for limited periods and expire according to cycles defined by QDS. The deletion of the Customer's data follows Section 10.5.