BizPilot UK — Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer (the "Controller") and NEXA DIGITAL PTY LTD trading as BizPilot, ABN 39 676 911 309, 1/22 O'Connell Street, North Adelaide SA 5006, Australia (the "Processor" / "BizPilot"). It applies where BizPilot processes personal data on behalf of the Customer and UK data-protection law, including the UK GDPR and Data Protection Act 2018, applies. Where the Customer determines the purposes and means of processing, the Customer is the controller and BizPilot the processor, unless the factual arrangement requires otherwise.

2. Processing Schedule

Subject matter — provision of the BizPilot Platform and Customer-selected modules.

Duration — for the duration of the Customer agreement and applicable retention period.

Nature of processing — may include collection; receipt; hosting; organisation; storage; retrieval; analysis; transmission; display; amendment; deletion; backup; and AI-assisted analysis where enabled.

Purposes — providing the functionality authorised by the Customer.

Data subjects — may include employees; workers; contractors; applicants; customers; restaurant guests; event attendees; Gift Card customers; suppliers; and Customer users.

Personal data categories — may include identity; contact; employment; payroll; recruitment; HR; attendance; location; training; compliance; financial; customer; transaction; and technical data.

Special category data — only where uploaded or lawfully processed through Customer-enabled workflows.

3. Documented instructions

BizPilot processes Customer Personal Data only on documented instructions from the Customer unless UK law requires otherwise, in which case BizPilot will inform the Customer of that legal requirement before processing where legally permitted. Documented instructions include: Customer Platform configuration; authorised API and integration setup; Customer actions within the Platform; Order Forms; support requests; and written instructions.

4. Confidentiality

Anyone authorised by BizPilot to process Customer Personal Data must be bound by confidentiality obligations, access data only where needed, and receive access appropriate to their responsibilities.

5. Security

BizPilot implements appropriate technical and organisational measures having regard to the nature of processing, the state of the art, costs of implementation, scope, context, purposes and risks to individuals. Currently implemented controls include encrypted connections (TLS), role-based access control, least-privilege permissions, authentication, audit logging of significant value and record changes, and managed cloud infrastructure. The Security Measures Schedule is maintained in the BizPilot Security & Trust Centre and may be updated as BizPilot matures, provided overall protection is not materially reduced.

6. Subprocessors

The Customer grants BizPilot general authorisation to appoint subprocessors necessary to provide the Platform. BizPilot maintains a public Subprocessor Register recording provider, purpose, data categories and processing region. BizPilot will provide a mechanism for Customers to receive notice of material new subprocessors and to object on reasonable data-protection grounds where applicable. Subprocessors are bound by appropriate data-protection obligations, and BizPilot remains responsible for their performance.

7. Data-subject rights

Taking into account the nature of the processing, BizPilot will provide reasonable assistance to the Customer in responding to relevant requests concerning access; correction; deletion; restriction; portability; objection; and relevant automated-decision rights. Requests received directly by BizPilot concerning processor data will ordinarily be referred to the relevant Customer unless law permits or requires BizPilot to respond directly.

8. Personal-data breaches

Where BizPilot becomes aware of a qualifying personal-data breach involving Customer Personal Data, BizPilot will notify the Customer without undue delay in accordance with applicable obligations, providing where available: the nature of the breach; date and time; systems affected; categories of data; approximate individuals affected; likely consequences; mitigation; and remediation.

9. DPIA and regulatory assistance

Taking into account the nature of processing and information available to BizPilot, BizPilot will provide reasonable assistance to Customers regarding DPIAs; risk assessments; regulator consultations; breach investigations; and security enquiries. Reasonable commercial fees may apply to unusually extensive bespoke assistance where legally permissible and agreed.

10. International transfers

BizPilot is operated by an Australian legal entity and may use international service providers. Where UK personal data is transferred internationally and a safeguard is required, BizPilot will use an appropriate lawful transfer mechanism, which may include UK adequacy arrangements, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another valid mechanism. Transfer information is recorded against each relevant subprocessor in the Subprocessor Register.

11. End of contract

At the Customer's choice and subject to applicable law, BizPilot will delete or return Customer Personal Data after services end. Exceptions may include legally required retention; fraud and security records; financial records; and backups awaiting normal rotation. Backups remain protected and are not restored for ordinary business use after deletion except where needed for disaster recovery or legal purposes.

12. Audits

BizPilot supports reasonable Customer audit rights required by applicable law, structured proportionately: Level 1 — standard security and privacy documentation; Level 2 — questionnaires or independent reports where available; Level 3 — additional audit cooperation for justified enterprise or regulatory requests. Physical inspections occur only where genuinely necessary, appropriately scoped, and subject to confidentiality, security requirements and reasonable notice. Nothing in this section removes audit rights required by applicable law.

NEXA DIGITAL PTY LTD trading as BizPilot · ABN 39 676 911 309

1/22 O'Connell Street, North Adelaide SA 5006, Australia

Privacy, complaints and legal enquiries: complaints@bizpilot.com.au