Data Processing Addendum

Version Information

• Version number: 4.1 (subprocessor update)
• Publish date: April 14th, 2026

Parties

Ledgy AG, a stock corporation formed under the laws of Switzerland, with company number CHE-261.454.963 (“Ledgy”), and the customer (the “Customer”) (each a “Party” and together the “Parties”), hereby agree as follows:

1. Scope

1.1 Applicability

This data processing addendum (the “Addendum”) applies exclusively to the processing of personal data (the “Customer Personal Data”) by Ledgy on behalf of the Customer where such processing is subject to European Union (EU), United Kingdom (UK), or Swiss data privacy law. This Addendum, including its annexes, forms part of, and is subject to, the provisions of the agreement between the parties (the “Services Agreement”).

1.2 Definitions

• EU Data Privacy Law: Regulation (EU) 2016/679 (GDPR).
• UK Data Privacy Law: All laws relating to data protection in force from time to time in the UK.
• Swiss Data Privacy Law: The Revised Federal Data Protection Act.
• Collectively referred to as “Data Privacy Law”.

1.3 Terms Definitions

Terms such as “processing”, “Personal Data”, “Controller”, “Processor”, “Data Subject”, “Sub-Processors” and “Data Breach” shall have the meaning ascribed to them in Data Privacy Law.

2. Binding Character of this Addendum

The Parties hereby agree to be bound by the provisions set forth in this Addendum in respect of their data protection obligations.

3. Details of Processing

3.1 Subject matter of processing

Equity management services via an online software application (the “Application”).

3.2 Duration of processing

For the duration of the Services Agreement until terminated.

3.3 Purpose of processing

Provision of the Services.

3.4 Categories of Personal Data

• Equity Data: Shareholder information, transaction history.
• General Personal Data: Name, surname, title, date of birth, contact information.

3.5 Categories of Data Subjects

Shareholders and natural persons who access and use the account (e.g., advisors).

4. Roles of the Parties

The Customer is the Controller, and Ledgy is the Processor.

5. Ledgy’s Obligations

Ledgy shall:

• Process Customer Personal Data on documented instructions from the Customer.
• Ensure personnel who access Customer Personal Data are committed to confidentiality.
• Maintain appropriate measures to protect Customer Personal Data.
• Assist the Customer in fulfilling obligations related to Data Subject rights.
• Delete personal data processed on behalf of the Customer after two years of inactivity.

6. The Customer’s Obligations

The Customer ensures:

• Instructions to process Customer Personal Data are compliant with Data Privacy Law.
• Customer Personal Data provided is accurate and updated when needed.
• Data Subjects have been notified about data storage periods.

7. Sub-processors

7.1 Authorisation

The Customer authorizes Ledgy to appoint Sub-Processors listed in Annex 2.

7.2 Responsibilities

Ledgy shall ensure agreements with Sub-Processors contain similar obligations.

8. Audit Rights

Ledgy shall maintain records of processing activities and provide access upon Customer request.

9. Personal Data Breach

In the event of a breach, Ledgy shall notify the Customer without undue delay.

10. International Transfers

Ledgy may transfer Customer Personal Data outside of the European Economic Area in compliance with applicable Data Privacy Law.

11. Data Subject Rights

Ledgy shall assist the Customer to respond to Data Subject requests and complaints.

12. Liability

Ledgy is not liable for losses due to Customer’s instructions contrary to Data Privacy Law.

13. Order of Precedence

This Addendum shall prevail over the Services Agreement in the event of conflict.

14. Survival

This Addendum shall survive the termination of the Services Agreement until Ledgy no longer processes Customer Personal Data.

Annex 1 - Technical and Organisational Measures

Organizational Security Measures

• Security Management: Ledgy oversees information security and has defined roles.
• Risk Management: Ongoing identification and management of IT-related risks.

Incident Response

• Procedures for handling and reporting data breaches.
• Business Continuity: Controls for maintaining processing continuity.

Human Resource Security

• Policy Compliance: Ensures employee understanding of data protection obligations.

Technical Security Measures

• Access Control: Rights assigned based on role necessity and least privilege.
• Data Encryption: Encryption of stored data and secure transmission over the Internet.

Annex 2 - List of Sub-Processors