BizPilot Australia — Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") forms part of the agreement between NEXA DIGITAL PTY LTD trading as BizPilot, ABN 39 676 911 309 ("BizPilot") and the Customer. It applies where BizPilot processes personal information contained in Customer Content on behalf of a Customer in connection with the BizPilot Platform.

2. Customer responsibility

The Customer is responsible for: determining why Customer Personal Information is processed; ensuring collection is lawful; providing required privacy notices; obtaining required consents; providing lawful processing instructions; and ensuring Platform configuration complies with applicable law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where applicable.

3. Processing instructions

BizPilot will process Customer Personal Information only: to provide the Platform; according to the Customer's authorised use and instructions; as otherwise permitted by the Customer agreement; or where required by applicable law. Documented instructions include the Customer's Platform configuration, authorised integrations, Customer actions within the Platform, Order Forms, support requests and written instructions.

4. Confidentiality

BizPilot ensures that personnel with access to Customer Personal Information are subject to appropriate confidentiality obligations and access information only where needed for their responsibilities.

5. Security

BizPilot will implement reasonable technical and organisational measures appropriate to the risks involved. Current measures include encrypted connections (TLS), role-based access controls, least-privilege permissions, authentication, audit logging of significant value and record changes, and managed cloud infrastructure. The applicable measures are described in the BizPilot Security & Trust Centre and may be updated as the Platform matures, provided overall protection is not materially reduced.

6. Subprocessors

BizPilot may use subprocessors required to deliver the Platform. BizPilot will: maintain an up-to-date public Subprocessor Register; require appropriate privacy and confidentiality obligations of its subprocessors; and remain responsible for its contractual obligations relating to subprocessor processing.

7. Overseas processing

Where Customer Personal Information may be disclosed outside Australia, BizPilot will handle overseas disclosure consistently with applicable Australian privacy obligations, including APP 8 where applicable. Material processing locations are identified in the Subprocessor Register.

8. Assistance

Where reasonably practicable and relevant, BizPilot will assist Customers with privacy requests; access and correction requests; security incidents; data export; and relevant privacy investigations.

9. Data breach notification

Where BizPilot becomes aware of a material security incident affecting Customer Personal Information, BizPilot will notify the Customer in accordance with applicable contractual and legal requirements, including obligations relevant to the Notifiable Data Breaches scheme.

10. Return and deletion

Following termination, BizPilot will return, make available for export, delete or de-identify Customer Personal Information in accordance with Customer instructions; the Customer agreement; legal retention obligations; and BizPilot's backup and retention procedures. Backups may be retained temporarily where securely isolated and deleted through normal retention cycles.

11. Audit and information

BizPilot will provide reasonable compliance and security information necessary for Customers to assess its handling of Customer Personal Information. Audit rights are structured proportionately: standard documentation is provided first; questionnaires or independent reports where available; and additional cooperation for justified enterprise or regulatory requests.

NEXA DIGITAL PTY LTD trading as BizPilot · ABN 39 676 911 309

1/22 O'Connell Street, North Adelaide SA 5006, Australia

Privacy, complaints and legal enquiries: complaints@bizpilot.com.au