Data Processing Addendum.

This Data Processing Addendum (the "DPA") sets out how the Jics company the Customer contracts with under the Terms and Conditions ("Jics", "we"; see Company information) processes personal data on behalf of the Customer when providing the Jics platform. It applies whenever the Customer's use of the platform involves the processing of personal data, without the need for a signature. It is written to meet, to the extent each applies to the Customer, Article 28 of the EU General Data Protection Regulation and of the UK General Data Protection Regulation (together, the "GDPR"); the Swiss Federal Act on Data Protection (the "FADP"); the California Consumer Privacy Act as amended (the "CCPA") and similar US state privacy laws; and the Nigeria Data Protection Act 2023 (the "NDPA") and the regulations made under it.

Terms such as personal data, processing, data controller, data processor, data subject, sub-processor and personal data breach have the meanings given in the data protection law that applies to the processing — the NDPA, the GDPR, the FADP or the relevant US state law. "Personal data" includes "personal information" as defined in US state privacy laws. Capitalised terms not defined here have the meaning in the Terms and Conditions.

The Customer is the controller of customer data. Jics acts as processor (a "service provider" or "processor" under US state privacy laws) and processes personal data only on the Customer's documented instructions — including the configuration of the platform, support requests, and these terms — unless the law requires otherwise, in which case we will tell the Customer first where the law allows. We will tell the Customer straight away if, in our opinion, an instruction breaks data protection law. Where the Customer's service provider has been delegated authority, their instructions count as Customer instructions.

Subject matter: the provision of the Jics fleet logistics platform.

Duration: the term of the Customer agreement plus any post-termination return-or-delete window.

Nature and purpose: hosting, processing, transmitting, securing and otherwise handling personal data so the Customer can manage its fleet, dispatch trips, track vehicles, raise alerts, verify deliveries, replay completed trips, and report on operations.

• the Customer's staff who use the dashboard (administrators, fleet managers, security managers),
• drivers and field staff who use the operator app or drive a tracked vehicle, including any passenger or bystander caught by a cabin or road camera,
• the Customer's own customers who receive tracking links and confirm deliveries, and
• any other person whose data the Customer chooses to load into the platform.

• Identity and contact: name, work email, phone, role, company.
• Authentication: credential metadata, sign-in events, session tokens, one-time codes.
• Location and vehicle data: registration, position, speed, direction, ignition, mileage, fuel, battery and sensor readings, routes, stops, events, driving scores.
• Video and sound: dash-camera clips and images (road and, where fitted, cabin), camera-detected events, panic-alert sound recordings, road photos for the dashboard's control room, which are shown and not stored, and live two-way cabin voice calls, which are relayed and not stored.
• Delivery confirmations: recipient details, one-time code, time, location, photo and signature.
• Device identifiers: tracker and SIM identifiers, phone push tokens, driver identity tags.
• Usage: features used, dashboards opened, performance telemetry.
• Free text: notes, comments and messages submitted by users.

No special categories of personal data are required by the service; the Customer must not load them without our written agreement.

We will:

• process personal data only on the Customer's documented instructions;
• ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations;
• implement appropriate technical and organisational measures (see section 8);
• engage another processor only as authorised in section 9;
• assist the Customer in fulfilling data subject rights, security obligations, data protection impact assessments and any prior consultation with a regulator, taking into account the nature of the processing;
• notify the Customer without undue delay of a personal data breach affecting their data;
• make available the information needed to show that we meet this DPA, and allow audits as set out in section 13; and
• at the end of the agreement, return or delete personal data as set out in section 14.

We apply the following measures and keep them under review:

• encryption of data in transit (TLS) and at rest with our hosting providers;
• each Customer's data separated at the database level, enforced on every query, so no user can read another Customer's records;
• role-based access in the dashboard and app; administrative access limited to named Jics staff;
• secrets and keys kept outside the code and rotated when staff or providers change;
• audit logs of sensitive actions, kept for the term of the agreement;
• daily backups by our hosting provider, an export of the data before every change to the database, and a documented restore procedure;
• security updates applied to our servers, and automated checks on every release.

A fuller description is available on request.

The Customer authorises the sub-processors listed in section 6 of the Privacy Notice (hosting, sign-in and storage; tracker gateway and map services; maps; app notifications; outgoing email; domain and email forwarding; payments). Where the Customer contracts with Plaman Engineering Limited Company, the Customer also authorises Plaman Engineering Limited, which develops, runs and supports the platform on that company's behalf. We bind each sub-processor in writing to data protection duties no less protective than this DPA and remain responsible for their work. We will publish any new or replacement sub-processor there at least 14 days before it starts processing Customer data; a Customer that objects on reasonable grounds may end the affected part of the service without penalty.

Personal data is stored in the European Union, passes through the United States and can be accessed by our support team in Nigeria, as set out in the Privacy Notice. We transfer only what the service needs.

EEA, United Kingdom and Switzerland

Where the Customer is subject to the GDPR or the FADP, and personal data is transferred to us, or by us to a sub-processor, in a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the "Clauses") apply and are incorporated into this DPA by reference — Module Two where the Customer is a controller and Module Three where it is a processor. For the Clauses: the Customer is the data exporter and we are the data importer; the optional clause 7 applies; option 2 of clause 9 applies, with the notice period in section 9; the optional wording in clause 11 does not apply; under clauses 17 and 18 the Clauses are governed by the law of Ireland and disputes go to the courts of Ireland; Annex I is completed by sections 3 to 6 of this DPA and the Customer's account details, Annex II by section 8, and Annex III by the sub-processor list in the Privacy Notice and section 9 of this DPA.

For transfers from the United Kingdom, the International Data Transfer Addendum to the Clauses issued by the UK Information Commissioner (version B1.0) also applies, with its tables completed by the information above, and either party may end it as its section 19 allows. For transfers from Switzerland, references in the Clauses to the GDPR are read as references to the FADP, and the competent supervisory authority is the Federal Data Protection and Information Commissioner.

If the Clauses conflict with this DPA, the Clauses prevail. We will help the Customer document these transfers, and any transfer impact assessment its own obligations require.

Nigeria

Transfers out of Nigeria are made under sections 41 to 43 of the NDPA, relying on contracts with each provider that require protection at least equivalent to the NDPA.

We will provide reasonable assistance to the Customer in responding to data subject requests for access, correction, deletion, restriction, portability or objection. Where a request is made directly to us by an end user of the Customer, we will forward it to the Customer without undue delay.

We will notify the Customer without undue delay, and in any event within 48 hours of confirming a personal data breach affecting its data, so that the Customer can notify its regulator within the time its law allows (72 hours under the GDPR and the NDPA). The notice will describe what happened, the data and people affected as far as known, the likely consequences and the steps taken. We will cooperate with the Customer to investigate and contain the incident and will not tell affected individuals on the Customer's behalf unless the Customer asks us to or the law requires it.

Once in any twelve months, or after a breach affecting its data, the Customer may on 30 days' notice and at its own expense audit our compliance with this DPA, during business hours and without disrupting the service. We will first answer a written questionnaire and share the reports or certifications we hold, which satisfy the audit where they cover the point in question.

For 30 days after the Customer agreement ends, the Customer may export all of its data from the dashboard, or ask us for a copy. After that we delete it, except where the law requires us to keep it. Copies in backups are overwritten within a further 14 days.

Where the Customer is subject to the CCPA or a similar US state privacy law, we act as its service provider or processor, and the Customer discloses personal information to us only for the business purposes described in section 4. We will:

• not sell or share the personal information, as those words are defined in the CCPA;
• not retain, use or disclose it for any purpose other than providing the service under the agreement, or as the CCPA otherwise permits a service provider, and not outside the direct business relationship between the Customer and us;
• not combine it with personal information we receive from or for anyone else, or collect ourselves, except as the CCPA permits;
• meet the obligations those laws place on us and give the personal information the level of protection they require;
• tell the Customer if we decide we can no longer meet these obligations, and let the Customer take reasonable steps to stop and put right any unauthorised use; and
• pass these duties on in writing to every sub-processor.

We certify that we understand these restrictions and will comply with them.

This DPA is effective from the start of the Customer agreement and remains in force for the duration of the agreement and the return-or-delete window. Each party's liability under this DPA is subject to the limits and exclusions in section 15 of the Terms and Conditions. Provisions which by their nature should survive — confidentiality, indemnities, limitations of liability, governing law — survive termination.

DPA questions or signed-copy requests can be sent to hello@jicsmotion.com.