Sprii DPA International Addenda

Purpose and how these addenda apply

This document, the Sprii DPAInternational Addenda, supplements and forms part of the Sprii Data ProcessingAddendum (the DPA). It groups the country-specific terms that apply when acustomer (the data controller) is governed by a data protection law outside theEU GDPR.

Each addendum below applies onlywhere, and to the extent that, the controller's processing is subject to thelaw it names. Where an addendum applies, it supplements the DPA; the DPA'sclauses (which implement Article 28 of the EU GDPR) continue to apply in full,read as referring to the equivalent concepts under the local law. If there is aconflict, the addendum prevails for that jurisdiction's law only.

The sub-processors Spriiengages, and the transfer safeguard relied on for each, are set out in theSprii Sub-Processor List referred to in the DPA. The transfer mechanisms namedbelow operate together with that List.

United Kingdom (UK GDPR and Data ProtectionAct 2018)

Application. Thisaddendum applies where the controller's processing is subject to the UK GDPRand the Data Protection Act 2018.

Supervisory authority. TheInformation Commissioner's Office (ICO).

Article 28 terms. Theclauses of the DPA apply as the data processor's obligations under Article 28of the UK GDPR, read with references to UK law and the ICO.

International transfers. Transfersfrom the UK to the EEA are covered by UK adequacy. For restricted transfers toother countries (for example the United States), the safeguard is the UKExtension to the EU-US Data Privacy Framework (the UK-US data bridge) where theimporter is certified, or otherwise the UK International Data TransferAgreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses,together with a transfer risk assessment. The safeguard relied on for eachsub-processor is recorded in the Sub-Processor List.

Personal data breach. Spriinotifies the controller as set out in the DPA, to support the controller'sassessment of whether to notify the ICO and data subjects.

Governing law of thisaddendum. England and Wales.

Switzerland (revised Federal Act on DataProtection)

Application. Thisaddendum applies where the controller's processing is subject to the SwissFederal Act on Data Protection (the revised FADP, in force 1 September 2023).

Supervisory authority. TheFederal Data Protection and Information Commissioner (FDPIC).

Article 28 equivalent. Theclauses of the DPA apply as the processor's obligations under the FADP.References to the GDPR are read as references to the FADP where it governs theprocessing.

International transfers. Transfersfrom Switzerland to countries the Federal Council recognises as adequate(including the EEA) may proceed on that basis. For other transfers, thesafeguard is the Swiss-US Data Privacy Framework where the importer iscertified, or otherwise the EU Standard Contractual Clauses with the FDPIC'sSwiss adaptations (the Swiss add-ons), together with a transfer impactassessment. The safeguard relied on for each sub-processor is recorded in theSub-Processor List.

Scope note. The revisedFADP protects personal data of natural persons only; references to datasubjects are read accordingly.

Personal data breach. Spriinotifies the controller as set out in the DPA, to support the controller'sassessment of whether to notify the FDPIC and data subjects.

Canada (PIPEDA and Quebec Law 25)

Application. Thisaddendum applies where the controller's processing is subject to the federalPersonal Information Protection and Electronic Documents Act (PIPEDA) and/orQuebec's Act respecting the protection of personal information in the privatesector, as amended by Law 25.

Authorities. The Officeof the Privacy Commissioner of Canada (OPC) federally, and the Commissiond'acces a l'information (CAI) in Quebec.

Service-provider terms. Consistentwith section 18.3 of the Quebec Act, Sprii processes personal information onlyfor the purposes of providing the Service, keeps it confidential, appliesappropriate security, does not use it for any other purpose, and does notretain it after the end of the contract except as required by law. Theseobligations mirror the DPA.

Cross-border processing. Wherepersonal information is communicated outside Quebec, the parties rely on thiswritten agreement, taking account of the results of the controller's privacyimpact assessment and any mitigation measures it identifies. Sprii will providethe information reasonably needed for that assessment.

Personal data breach. Spriinotifies the controller without undue delay as set out in the DPA, to supportthe controller's reporting obligations to the OPC, the CAI and affectedindividuals.

Australia (Privacy Act 1988 and theAustralian Privacy Principles)

Application. Thisaddendum applies where the controller's processing is subject to the AustralianPrivacy Act 1988 and the Australian Privacy Principles (APPs).

Authority. The Office ofthe Australian Information Commissioner (OAIC).

Handling of personalinformation. Sprii handles personal information consistently with the APPsto the extent they apply to its role as processor, and assists the controllerin meeting its APP obligations, including responding to requests fromindividuals.

Cross-border disclosure (APP8). The controller remains accountable for personal information disclosedto overseas recipients. Sprii takes reasonable steps to handle personalinformation consistently with the APPs and to ensure its sub-processors do thesame. The Privacy and Other Legislation Amendment Act 2024 allows countries andbinding schemes to be prescribed for overseas disclosures; none has beenprescribed yet, and the parties will rely on one if it becomes relevant.

Notifiable data breaches. Spriinotifies the controller without undue delay as set out in the DPA, to supportthe controller's obligations under the Notifiable Data Breaches scheme.

United States (State Privacy Laws)

Application. Thisaddendum applies where the controller is subject to one or more US stateprivacy laws, including the California Consumer Privacy Act as amended by theCalifornia Privacy Rights Act (CCPA/CPRA), and the comprehensive laws of statessuch as Virginia, Colorado, Connecticut and Utah, and the further states inforce from time to time. It is intended to satisfy the common service-providerand processor contracting requirements across those laws.

Role. Sprii acts as aservice provider or processor (as those terms are defined by the applicablelaw) and not as a third party, business, or controller, in respect of thepersonal information it processes for the controller.

Sprii will:

• process personal information only for the businesspurposes set out in the DPA and the customer's instructions, and not for anyother purpose;
• not sell or share personal information, and not use itfor cross-context behavioural advertising;
• not retain, use, or disclose personal informationoutside the direct business relationship with the controller, or as otherwisepermitted by the applicable law;
• not combine personal information with other informationexcept as permitted by the applicable law;
• assist the controller in responding to consumer rightsrequests (access, deletion, correction, and opt-out) to the extent applicable;
• maintain reasonable security and notify the controllerof a security incident as set out in the DPA;
• allow the controller to take reasonable and appropriatesteps to ensure Sprii’s processing complies with the applicable law, and tostop and remediate unauthorised processing;
• engage sub-processors only on equivalent terms, asdisclosed in the Sub-Processor List; and
• notify the controller if it determines it can no longermeet its obligations under the applicable law.

State variations. Where astate law requires a contract term not covered above, Sprii will agree it withthe controller on request.

Chile (Law 21.719)

Application. Thisaddendum applies where the controller's processing is subject to Chilean Law21.719 on the protection of personal data, which is scheduled to enter intoforce on 1 December 2026.

Authority. The Agencia deProteccion de Datos Personales (the Chilean Data Protection Agency).

Mandate (processor) terms. Sprii(the mandated party) processes personal data only on the controller'sdocumented instructions, keeps it confidential, applies appropriate security,assists the controller with data-subject rights and with breach notification,and deletes or returns the data on termination, and engages sub-processors onlyon equivalent terms. These obligations mirror the DPA.

Principles and lawful bases. Processingfollows the principles of lawfulness, purpose limitation, proportionality, dataquality, security, transparency, confidentiality, and accountability, and mayrely on bases including the controller's consent, performance of a contract,and legitimate interest, as provided by the law.

Forward-looking status. Thisaddendum is drafted ahead of the law's entry into force. Sprii will update itwhen the Agency issues implementing regulations or guidance, or if theentry-into-force date changes.

Status and review

Each addendum is conditional and is dormant unless the named law appliesto the controller's processing. This document will be reviewed on each materialchange to the underlying laws and at least annually alongside theregulatory-watch review.