DATA PROCESSING AGREEMENT

Annex to the Vendor Agreement · My Trusted Share Pte Ltd

v1.3 · Effective: 29 September 2026

1. INTRODUCTION

This Data Processing Agreement (“DPA”) forms part of the Vendor Agreement between My Trusted Share Pte Ltd (UEN 201634648K) (“MTS”, “Processor”) and the Vendor (“Vendor”, “Controller”).

This DPA is a contract evidenced in writing for the purposes of section 4(2) of the Singapore Personal Data Protection Act 2012, and a contract for the purposes of Article 28 of the GDPR and UK GDPR.

Capitalised terms not defined here have the meaning given in the Vendor Agreement. In the event of conflict between this DPA and the Vendor Agreement in respect of personal data, this DPA prevails.

2. DEFINITIONS

“Account” — a registered account on the Platform, whether held by a Vendor, a Referral Partner or another User.

“Applicable Data Protection Law” — the Singapore Personal Data Protection Act 2012 (“PDPA”); the EU General Data Protection Regulation 2016/679 (“GDPR”); the UK GDPR and Data Protection Act 2018; the Australian Privacy Act 1988; the New Zealand Privacy Act 2020; PIPEDA and Quebec Law 25; applicable US state privacy laws; and any other data protection law applicable to the processing.

“Controller” — the Vendor. Under the PDPA, the “organisation” on whose behalf personal data is processed.

“Data Subject” — an identified or identifiable individual, including a Referred Lead.

“Personal Data” — personal data, personal information or equivalent under Applicable Data Protection Law, processed by MTS on the Vendor’s behalf under the Vendor Agreement.

“Processor” — MTS. Under the PDPA, a data intermediary.

“Security Incident” — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data. It does not include an unsuccessful attempt, or an activity that does not compromise the security of Personal Data, including an unsuccessful log-in attempt, a ping, a port scan, a denial-of-service attack, or any other unsuccessful attack on network infrastructure or systems.

“Subprocessor” — a third party engaged by MTS to process Personal Data. A supplier that does not process Personal Data is not a Subprocessor.

“Vendor” — MTS’s customer, being the party that has entered into the Vendor Agreement. Vendors are MTS’s customers. Where this DPA, the Platform, our website or our communications refer to our “clients” or “customers”, they mean Vendors. “Vendor” does not mean a supplier to MTS — the third parties who supply services to us are referred to in our documents as Suppliers, or as Subprocessors where they process Personal Data on our behalf.

3. ROLES — READ THIS SECTION CAREFULLY

3.1 The Vendor is the Controller

The Vendor is the Controller of Personal Data relating to Referred Leads. The Vendor determines the purposes and means of processing, decides what Campaigns to run, decides who to contact, and decides what to do with lead data.

3.2 MTS is the Processor / data intermediary

MTS processes Referred Lead Personal Data only on the Vendor’s behalf, on the Vendor’s documented instructions, and for the Vendor’s purposes. MTS is a data intermediary under section 4(2) PDPA and a processor under Article 28 GDPR.

3.3 Where MTS is a Controller in its own right

MTS is not a processor for everything. MTS acts as a controller (and as an organisation in its own right under the PDPA) in respect of:

• Vendor account and billing data;
• Referral Partner account data — Referral Partners hold accounts directly with MTS — including each Referral Partner’s own record of the referrals they submitted and the rewards recorded against them, which MTS keeps for that Referral Partner. That record is unaffected by a Vendor cancelling its Subscription, by termination of the Vendor Agreement, by any election the Vendor makes under clause 12, or by the deletion of the Vendor’s account;
• User account data generally;
• website visitor data, cookies and analytics relating to MTS’s own sites;
• data processed for MTS’s own security, fraud prevention, legal compliance and service administration purposes; and
• the Platform activity record described in clause 9.5 of the Vendor Agreement — MTS’s own record of what was done on the Platform and when, which MTS keeps for the purposes stated in that clause.

MTS’s processing in those capacities is governed by the MTS Privacy Policy, not by this DPA. Data MTS processes as a controller under this clause is not Personal Data processed on the Vendor’s behalf, and clause 12 does not apply to it.

3.4 No joint controllership

The parties do not intend to act as joint controllers. Each is independently responsible for its own compliance in its own capacity.

4. SCOPE AND DETAILS OF PROCESSING

4.1 Subject matter

Provision of the Platform under the Vendor Agreement.

4.2 Duration

For the term of the Vendor Agreement, plus the retention period in clause 12.

4.3 Nature and purpose

Collection, recording, organisation, storage, retrieval, display, transmission and erasure of referral and lead data, in order to record referral activity, attribute referrals, display lead status, and record reward status, and any other processing of that data necessary to provide, secure and support the Platform.

4.4 Categories of Data Subject

Referred Leads; Referral Partners (in respect of data shared with the Vendor); Vendor personnel.

4.5 Categories of Personal Data

Subject to clause 4.6:

• the details of a Referred Lead that relate to an individual, including their name, contact details, job title and the organisation they are associated with; and
• the referral and reward records held in the Vendor’s account, including the Referral Partner credited and the status and amount the Vendor records.

The Platform activity record described in clause 3.3(f), and each Referral Partner’s own record described in clause 3.3(b), are MTS’s own and are not within this clause.

4.6 Data MTS does not collect

MTS does not collect, and the Vendor must not submit to the Platform: NRIC, FIN, passport or other national identification numbers; dates of birth; financial account or payment card details of Referred Leads or Referral Partners; special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation); or criminal offence data.

If the Vendor requires tax identity information for IRAS e-Submission or any other purpose, the Vendor must collect and hold it outside the Platform, and is solely responsible for doing so lawfully.

5. VENDOR OBLIGATIONS

The Vendor warrants and undertakes that:

5.1 Lawful basis. It has, and will maintain, a valid lawful basis and (where required) consent for the collection, use and disclosure of Personal Data processed through the Platform, including for Referred Leads whose details are submitted by a Referral Partner.

5.2 Notices. It will provide all notices required by Applicable Data Protection Law to Data Subjects, including any notice required within thirty (30) days where Personal Data was not obtained from the Data Subject directly (Article 14 GDPR).

5.3 Instructions. Its instructions to MTS will comply with Applicable Data Protection Law.

5.4 Accuracy of submissions. It will not use the Platform to process Personal Data obtained unlawfully, scraped, purchased, or supplied without authority.

5.5 Marketing compliance. It will comply with clause 8.1 of the Vendor Agreement before contacting any Referred Lead, including its own DNC screening for Singapore numbers.

5.6 Data subject relations. It is responsible, as Controller, for responding to Data Subject requests.

5.7 Account security. MTS makes multi-factor authentication available for Accounts. Whether to enable it is the Vendor’s choice. The Vendor’s responsibility for the security of its credentials and for activity under its Account is set out in clause 4.4 of the Platform Terms of Use.

6. MTS OBLIGATIONS

6.1 Processing on instructions

MTS will process Personal Data only on the Vendor’s documented instructions, which are constituted by the Vendor Agreement, this DPA and the Vendor’s use of Platform functionality — unless required otherwise by law, in which case MTS will inform the Vendor first unless legally prohibited.

6.2 Notification of unlawful instruction

If MTS considers an instruction infringes Applicable Data Protection Law, it will inform the Vendor without undue delay and may suspend performance of that instruction.

6.3 Confidentiality

MTS will ensure personnel authorised to process Personal Data are bound by confidentiality obligations and receive appropriate training.

6.4 Assistance

Taking into account the nature of processing and the information available to MTS, MTS will provide reasonable assistance to the Vendor, insofar as this is possible, in relation to:

• responding to Data Subject requests for access, correction, erasure, portability, restriction or objection;
• data protection impact assessments and prior consultation;
• Security Incident notification obligations.

What this assistance is, and is not. This assistance is owed to the Vendor. MTS does not respond to Data Subject requests on the Vendor’s behalf, does not conduct the Vendor’s assessments, and does not prepare the Vendor’s notifications — those are the Vendor’s responsibility under clauses 5.6 and 8.3. Where a Data Subject contacts MTS directly, MTS will refer the request to the Vendor and tell the Data Subject who the Vendor is.

MTS’s assistance consists of making available the information MTS holds and the Platform functionality that exists from time to time. Where Applicable Data Protection Law requires MTS to assist by appropriate technical and organisational measures, those measures are provided through the Platform’s own search, export and record-management functions. MTS is not required to build, modify or add Platform functionality in order to assist the Vendor, though it may agree to do so under the charging provisions below.

Assistance MTS provides without charge. MTS provides the following without charge: the notification and information under clauses 8.1 and 8.2; and any information or record MTS can produce using the Platform’s standard export and reporting functions.

Assistance MTS charges for. Any other assistance is chargeable by MTS. This includes assistance that requires MTS to write or run a new query, script or tool, to produce a report the Platform does not already produce, or that requires more than two (2) hours of MTS personnel time in aggregate.

How charges are agreed and paid. MTS will quote the work and the charges to the Vendor in writing before starting. MTS is not required to begin, or to continue, until the Vendor has approved that quote in writing and paid it in full. Charges are calculated at MTS’s standard professional services rates in force at the time — charge-out rates reflecting both the cost of the personnel involved and the cost to MTS of diverting them from their normal duties — and are not limited to MTS’s internal or salary cost. Where the work requires more than the quoted time, the additional work is quoted, approved and paid for in advance in the same way. The Vendor bears its own costs.

6.5 Records

MTS will maintain records of its processing activities as required by Applicable Data Protection Law. Clause 11 governs the information MTS makes available to the Vendor, and any audit or assessment.

7. SECURITY

7.1 Measures

MTS will implement and maintain appropriate technical and organisational measures, having regard to the state of the art, cost, and the nature, scope, context and purposes of processing, comprising:

• encryption of Personal Data in transit and at rest;
• access controls limiting access to Personal Data to authorised personnel, including multi-factor authentication available for Accounts;
• logical separation of Vendor data;
• logging of Platform activity;
• regular backup of Personal Data;
• vulnerability management and patching;
• a documented information security policy and incident response plan;
• personnel background checks where lawful and appropriate.

7.2 Changes to the measures

MTS may update or replace the measures described in clause 7.1 from time to time, provided MTS continues to maintain a level of security appropriate to the risk.

8. SECURITY INCIDENTS

8.1 Notification to the Vendor

MTS will notify the Vendor without undue delay after becoming aware of a Security Incident affecting Personal Data processed on the Vendor’s behalf.

This clause applies to a Security Incident affecting systems or facilities operated by MTS or a Subprocessor. It does not apply to an incident originating in the Vendor’s own systems, devices or personnel, or arising from the compromise, loss or unauthorised use of Account credentials — unless the incident also results from a failure of MTS’s security measures under clause 7. Clause 8.5 applies to those incidents.

MTS will notify the Vendor by email, at the Vendor’s account email address. The Vendor is responsible for keeping that address current and monitored. Notices are given as set out in clause 17 of the Vendor Agreement.

8.2 Content

The notification will comprise, to the extent known: the nature of the incident, categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases as it becomes available.

8.3 Vendor’s obligations

The Vendor, as Controller, is responsible for assessing and making any notification to a supervisory authority or to Data Subjects required by Applicable Data Protection Law. Those obligations are the Vendor’s alone. They include assessing whether the incident is notifiable, notifying the relevant authority within the period its law allows, and notifying affected Data Subjects where required.

Where the Vendor requires assistance from MTS beyond the notification under clauses 8.1 and 8.2, MTS may charge the Vendor for that assistance and clause 6.4 applies — including MTS’s written quote, the Vendor’s written approval, and payment in full before MTS begins.

8.4 No admission

Notification is not an acknowledgement of fault or liability.

8.5 The Vendor’s own incidents

The Vendor will notify MTS immediately, at support@mytrustedshare.com, on becoming aware of any Security Incident affecting Personal Data in the Vendor’s own systems, or arising from the use of its Account — including the compromise, loss or unauthorised use of Account credentials — where the incident affects, or may affect, the Platform or Personal Data held on it. This is in addition to clause 4.4 of the Platform Terms of Use. The Vendor will provide the information MTS reasonably requires in order to contain the incident.

9. SUBPROCESSORS

9.1 General authorisation

The Vendor gives general written authorisation for MTS to engage Subprocessors.

9.2 Current Subprocessors

A current list is maintained at https://www.mytrustedshare.com/subprocessors.

9.3 Changes

We will update the Subprocessor list referred to in clause 9.2 before engaging a new or replacement Subprocessor.

Where Applicable Data Protection Law requires us to inform you of such a change and give you an opportunity to object — including Article 28(2) of the GDPR and UK GDPR — we will give you at least fourteen (14) days’ notice in writing before the change takes effect, and you may object on reasonable data protection grounds before it takes effect. If we cannot resolve your objection, you may terminate the Vendor Agreement with effect from the date the change takes effect; Fees already paid are not refunded. If you do not object before the change takes effect, you are treated as having accepted it.

Where a Subprocessor must be replaced urgently to maintain the security, availability or continuity of the Platform — including where a Subprocessor ceases to provide its service, becomes insolvent, or presents a security risk — we may make the change immediately and will notify you as soon as practicable afterwards. Your right to object under this clause then applies from the date of that notice.

9.4 Flow-down

MTS will take reasonable steps to use Subprocessors that are subject to data protection obligations covering their processing of Personal Data, whether under their own published data protection terms or terms agreed with us. This clause concerns compliance with data protection obligations only. It does not create any service level, availability or performance commitment.

9.5 Integrations you enable

Where you enable an integration between the Platform and a third-party service, that service is not our Subprocessor. You are responsible for your relationship with that service, for the lawfulness of the transfer, and for any Personal Data once it leaves the Platform at your instruction.

10. INTERNATIONAL TRANSFERS

10.1 Locations

Personal Data is stored and processed in Singapore and the United States, and in any additional locations identified on the Subprocessor list referred to in clause 9.2. That list identifies our current Subprocessors and the locations in which they process Personal Data.

10.2 Transfer mechanisms

Where Personal Data is transferred out of a jurisdiction that restricts such transfers, MTS will take reasonable steps to ensure that recipients are bound by legally enforceable obligations providing a standard of protection comparable to the PDPA, satisfying the Transfer Limitation Obligation.

10.3 Supplementary measures and government access requests

MTS applies the technical and organisational measures described in clause 7 to Personal Data transferred internationally, together with any supplementary measures MTS identifies as appropriate for a particular transfer.

Where MTS receives a request from a public authority for disclosure of Personal Data, MTS will review the legality of the request and, where after careful assessment MTS concludes that there are reasonable grounds to consider the request unlawful, MTS will challenge it and pursue available avenues of appeal. MTS will not disclose more Personal Data than the request requires.

11. AUDIT

11.1 Information

MTS will, on reasonable written request, make available information reasonably necessary to demonstrate compliance with this DPA, including relevant third-party audit reports, certifications, security documentation, and MTS’s own completed standard security questionnaire, in each case where MTS has it available.

MTS is not required to complete a security questionnaire, assessment form or template supplied by the Vendor or by a third party. Where MTS agrees to complete one, that work is chargeable under clause 6.4.

MTS need not respond to a request that is manifestly unfounded or excessive, including because of its repetitive character.

For processing to which clause 11.2 does not apply, this clause is MTS’s complete obligation in respect of audits and assessments.

11.2 Audits, where required by law

This clause applies only where Applicable Data Protection Law requires MTS to allow for and contribute to audits of the processing — including Article 28(3)(h) of the GDPR and UK GDPR, and equivalent provisions of applicable US State privacy laws. The Vendor will identify the requirement it relies on. Where an applicable law permits MTS to satisfy an assessment obligation by providing an independent third-party assessment or certification, MTS may do so.

Where this clause applies and the information provided under clause 11.1 is insufficient, the Vendor may audit MTS’s compliance with this DPA, no more than once in any twelve (12) month period, on at least thirty (30) days’ written notice.

An audit is limited to the systems, records and documentation relevant to MTS’s processing of that Vendor’s Personal Data, must be conducted during business hours, must not disrupt MTS’s operations, and must not access any other customer’s data, systems or personnel records.

The Vendor may appoint an independent third-party auditor. MTS may object, on reasonable grounds, to an auditor that competes with MTS, is not independent, or will not give MTS a written confidentiality undertaking; the Vendor may then appoint another.

An audit does not include penetration testing, vulnerability scanning, or access to source code, and does not permit the connection of any device or tool to MTS’s systems.

MTS may decline a request made in the course of an audit where complying with it would: disclose another customer’s data or confidential information; disclose MTS’s trade secrets or source code; compromise the security or integrity of the Platform; breach a legal or contractual obligation MTS owes to a third party; or fall outside the scope agreed under this clause. Where MTS declines, it will say why, and will offer an alternative means of addressing the auditor’s underlying question where one is reasonably available.

Scope, timing and MTS’s charges are to be agreed in writing in advance. MTS’s charges for an audit are calculated at MTS’s standard professional services rates in force at the time — charge-out rates reflecting both the cost of the personnel involved and the cost to MTS of diverting them from their normal duties — and are not limited to MTS’s internal or salary cost. The agreed charges are payable by the Vendor in full before the audit begins, and MTS is not required to begin until they are paid. Where an audit requires work beyond the agreed scope or hours, that additional work is to be agreed and paid for in advance before it is carried out or the audit continues. The Vendor bears its own costs.

An additional audit may be conducted by the Vendor where a supervisory authority requires the Vendor to conduct one, or following a confirmed Security Incident affecting that Vendor’s Personal Data — in each case subject to the same notice, scope, conditions and charges as above.

11.3 Confidentiality of information provided

Information provided under this clause 11, and anything learned in the course of an audit, is MTS’s confidential information. It is provided solely for the purpose of the Vendor’s own compliance assessment, and must not be disclosed to any third party — other than the Vendor’s professional advisers under equivalent obligations of confidence, or as required by law — or published.

12. RETENTION AND DELETION

12.1 On termination

Access to the Vendor features of the Platform ends on termination, as set out in clause 15.5 of the Vendor Agreement; the Vendor is responsible for exporting Personal Data before then.

MTS will retain Personal Data for thirty (30) days after termination. During that period the Vendor may notify MTS in writing, at support@mytrustedshare.com, whether it requires the Personal Data to be deleted or returned, and MTS will act on that choice. If the Vendor does not notify a choice within that period, MTS will delete the Personal Data at the end of it. A return under this clause comprises the Personal Data that the Platform’s standard export function produces from MTS’s live production systems at the time MTS acts on the Vendor’s choice — the same export the Vendor was able to run for itself while its Subscription was active, run by MTS because Platform access has ended — and is chargeable in accordance with clause 6.4. It does not extend to Personal Data held in backups, archives or snapshots, which are dealt with in clause 12.2, nor to Personal Data already deleted in accordance with this clause. MTS may withhold or defer a return where it reasonably considers it necessary in connection with suspected fraud, a security incident, or a legal or regulatory investigation, to the extent permitted by law.

12.2 Exceptions

MTS may retain Personal Data to the extent required by law, and in routine backups and incidental records of support communications until those backups and records expire in the ordinary course — during which time the data remains subject to this DPA and will not be actively processed.

12.3 Copies provided to the Vendor

Where MTS provides the Vendor with a copy of a recording, document or file — including a recording of an onboarding, training or support session — the Vendor holds that copy as Controller from the time it is provided, and is responsible for its storage, retention, deletion and any onward disclosure. MTS’s obligations under this clause 12 apply to MTS’s own copy only.

13. AGGREGATED AND ANONYMISED DATA

13.1 MTS may create aggregated and anonymised data derived from Personal Data, and may use it for operating, securing, analysing, benchmarking and improving MTS’s services and for statistical and research purposes.

13.2 Such data will be aggregated and anonymised so that no Data Subject, Vendor or Referral Partner is identifiable, and MTS will apply appropriate measures designed to prevent re-identification. Where data has been anonymised so that identification is no longer reasonably likely by any means reasonably likely to be used, it is not Personal Data and this DPA does not apply to it.

13.3 For the avoidance of doubt, MTS will not use identifiable Referred Lead Personal Data for MTS’s own purposes, will not sell or license it, and will not use it to market to Referred Leads.

13.4 MTS will not use Personal Data to train, fine-tune or otherwise improve machine learning or artificial intelligence models for MTS’s own purposes or for the benefit of any other customer, and will not permit any Subprocessor to do so, unless the Vendor opts in in writing.

This does not restrict:

• Platform functionality operating on the Vendor’s own Personal Data for that Vendor, including attribution proposals, matching and duplicate detection;
• detecting and preventing fraud, abuse and improper conduct across the Platform, using the Platform activity record described in clause 9.5 of the Vendor Agreement, which holds no Referred Lead contact details of its own; and
• aggregated and anonymised data under clauses 13.1 and 13.2, which is not Personal Data.

14. LIABILITY

The limitations and exclusions of liability in clause 14 of the Vendor Agreement apply to claims under this DPA, except where Applicable Data Protection Law does not permit such limitation. Nothing in this DPA limits a Data Subject’s rights against either party under Applicable Data Protection Law.

15. GENERAL

Interpretation. In this DPA, unless the context otherwise requires: words in the singular include the plural and vice versa; headings are for convenience only and do not affect interpretation; a reference to a statute includes that statute as amended or replaced; and “writing” includes email.

Where this DPA refers to an account on the Platform, that reference means an Account, whether or not capitalised, unless the context requires otherwise.

Term. This DPA takes effect on acceptance of the Vendor Agreement and continues until processing ceases and deletion is complete.

Amendment. MTS may amend this DPA on fourteen (14) days’ notice, including to reflect changes in Applicable Data Protection Law, to adopt new or replacement transfer mechanisms, and to reflect changes to the Platform or to MTS’s operations. Where an amendment would materially and adversely affect the Vendor’s rights under this DPA, clause 16 of the Vendor Agreement applies to it as if it were a material change to that agreement. Changes to Subprocessors are governed by clause 9.3 and are not amendments to this DPA.

Administrative changes. A change to this DPA that does not reduce the Vendor’s rights or increase the Vendor’s obligations is not an amendment requiring notice under this clause. This includes a change to MTS’s registered office address, contact details or entity particulars; the correction of a typographical, grammatical or formatting error; the correction of a clause number or cross-reference; and a change to the presentation, layout or structure of this DPA. MTS will publish the updated DPA with a new version number and effective date, and the change takes effect on publication.

Governing law. Singapore.

Order of precedence. This DPA → the Vendor Agreement.

Data Protection Officer: dpo@mytrustedshare.com

My Trusted Share Pte Ltd · UEN 201634648K · Incorporated in Singapore