BROKER.FARM — DATA PROCESSING AGREEMENT

Version: 1.0
Effective date: 4 November 2026
Data protection contact: valeriya@berrini.farm

This Data Processing Agreement (the DPA) forms part of the Broker.farm Terms of Service (the Terms). It applies when Broker.farm processes personal data on behalf of a Customer in connection with the Service.

Processor: Wojciech Oksiński, conducting business as IT Wojciech Oksiński, ul. Sienna 72a/203, 00-833 Warsaw, Poland, NIP 1231152265, REGON 363313210 (Broker.farm, Provider, Processor or we).

Customer: the business, professional or other organisation identified in the Organisation Account and bound by the Terms (the Customer).

KEY POINTS

• Your organisation decides what to connect and process. The Customer determines which authorised email accounts, WhatsApp sources, message archives, Users and business information are made available through Broker.farm.
• Messages may be stored without AI Analysis. Broker.farm may receive and retain Messages and attachments before AI Analysis takes place, including Messages from Ignored contacts, unclassified senders and Messages received during a zero-credit period, as described in the Terms.
• AI processing follows the Customer's instructions and Service settings. Only eligible Messages are submitted for AI Analysis in accordance with the applicable Service functions and the Terms.
• Support access is restricted to legitimate operational purposes. Authorised Provider personnel may access Customer information through administrative tools for onboarding, support, troubleshooting, extraction-quality checks, security, export and deletion, subject to confidentiality and security controls.
• Service suppliers process data under contractual safeguards. Authorised sub-processors are identified in Schedule 3. Applicable international-transfer safeguards are addressed in Section 7.
• The Customer retains control of its data. Return, export, deletion, switching-related assistance and the processing of retained data are governed by this DPA, the Terms and applicable law.

The provisions below govern the parties' rights and obligations.

1. SCOPE, ROLES AND CONTRACT DOCUMENTS

1.1. Customer Personal Data means personal data processed by the Provider on behalf of the Customer within its Organisation Account, including connected or imported correspondence, contacts, attachments, customer-entered records and personal information extracted from communications. It also includes user and permission information to the extent processed on the Customer's instructions for its workspace. The processing is described in Schedule 1.

1.2. The Customer acts as a controller when it determines the purposes and essential means of processing Customer Personal Data. If the Customer processes that data on behalf of another controller, the Customer acts as a processor and Broker.farm acts as its sub-processor. The Customer confirms that it is authorised to appoint Broker.farm, give instructions and enter into this DPA in either case.

1.3. The Provider acts as an independent controller for processing that it determines for its own purposes, including account and business relationship administration, direct communications with the Customer, billing, statutory compliance, and the security and protection of its own business. Such processing is explained in the Broker.farm Privacy Policy and is outside this DPA. The same item of personal data may be processed in different roles for distinct purposes; each role is determined by the particular processing activity.

1.4. This DPA, including its Schedules, is incorporated into the Agreement under Section 1 of the Terms. It takes precedence over the Terms and Pricing Schedule in the event of a conflict concerning processing of Customer Personal Data. Mandatory data protection law prevails.

1.5. References to personal data, processing, controller, processor, personal data breach and data subject have the meanings given in Regulation (EU) 2016/679 (the GDPR). This DPA establishes the contractual processor safeguards required by Article 28 GDPR where that Regulation applies.

2. PROCESSING INSTRUCTIONS AND DETAILS

2.1. Schedule 1 specifies the subject matter and duration of processing, its nature and purposes, types of personal data, categories of data subjects, and the obligations and rights of the Customer.

2.2. The Customer instructs the Provider to process Customer Personal Data as necessary to deliver, operate, secure and support the Service functions selected and authorised through the Organisation Account. These documented instructions include:
(a) connecting and maintaining authorised email accounts, WhatsApp sources and supported message archives;
(b) importing available Historical Messages when a Connected Source is first connected, whether during or after the initial Onboarding;
(c) receiving, transmitting, copying, storing, organising and displaying incoming and outgoing Messages, associated metadata and attachments;
(d) performing AI Analysis of eligible Messages and generating, recording, displaying and updating extracted business information, subject to the Customer's settings and the applicable processing rules in the Terms;
(e) receiving and storing Messages without AI Analysis where a contact is marked Ignored, a sender remains unclassified, available Message Credits have been exhausted or another applicable processing restriction applies;
(f) managing Organisation Account permissions, authorised Users, integrations, security controls and necessary technical records;
(g) performing authorised onboarding, customer support, troubleshooting, quality checks, backup and recovery operations; and
(h) assisting with access requests, return, export, switching, restriction and deletion of Customer Personal Data in accordance with this DPA, the Terms and applicable law.

2.3. The Customer may provide additional documented instructions through available account controls, written support requests or an agreed Order. The Provider will reasonably assist in assessing an instruction that falls outside normal functionality. Additional services may require a separately agreed fee, but compliance with mandatory obligations is not conditional on payment.

2.4. When the Customer marks a contact as Ignored, Messages associated with that contact are excluded from subsequent AI Analysis while the setting applies. The Provider may nevertheless continue receiving and storing those Messages and their attachments as part of the Customer's workspace, subject to the applicable Service configuration and retention rules.
Marking a contact Ignored is not an instruction to delete previously stored or subsequently received Messages. If the Customer removes the Ignored designation, retained correspondence may become eligible for further processing under the Customer's instructions, available Service functions and the credit rules in the Terms.
The Customer may separately instruct the Provider to delete retained information in accordance with Section 9.

2.5. Messages from unclassified senders. The Provider may receive and store Messages from senders that the Customer has not yet classified as recognised business contacts or persons. Such Messages shall not be submitted for AI Analysis solely because they have been received or stored. Further analysis may occur only when the Message becomes eligible under the Customer's classification decision, applicable Service settings and the Terms.

2.6. Processing when Message Credits are exhausted. Where the Customer's available Message Credit balance reaches zero, the Provider shall suspend further chargeable AI Analysis in accordance with the Terms.

For the next 30 calendar days, the Provider shall continue receiving and storing new Messages, attachments and related metadata from active Connected Sources, subject to the availability and technical limitations of the relevant integrations and third-party services, without submitting those Messages for chargeable AI Analysis.

If the balance remains at zero after that period, the Provider shall stop collecting new Messages in accordance with Section 9 of the Terms. Suspension of AI Analysis or Message collection does not, by itself, constitute deletion of Customer Personal Data already retained by the Service.

2.7. Processing following reactivation. If the Customer replenishes its Message Credit balance and the Service resumes, any AI Analysis of Messages retained during the preceding zero-credit period shall be governed by the selected and applicable version of Section 9.7 of the Terms. Where that version requires a separate Customer decision before analysing retained Messages, the Provider shall not submit those Messages for AI Analysis without the required instruction. Where retrospective analysis is excluded, the Provider shall not submit the relevant backlog for AI Analysis merely because the balance has been replenished. Retained Messages remain subject to the Customer's applicable instructions and the return, export and deletion requirements of Section 9 of this DPA.

3. PROCESSING ONLY ON DOCUMENTED INSTRUCTIONS

3.1. The Provider shall process Customer Personal Data only on documented instructions from the Customer, including in relation to transfers to a third country or an international organisation, unless processing is required by Union or Member State law to which the Provider is subject. In that case, the Provider shall inform the Customer of the legal requirement before processing, unless that law prohibits the information on important grounds of public interest.

3.2. The Provider shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions. It may suspend only the affected processing while the instruction is clarified, except where applicable law requires another approach.

3.3. The Customer is responsible for the lawfulness of its collection and use of Customer Personal Data, including appropriate legal bases, notices, access permissions and the authority to connect mailboxes, WhatsApp sources or imported chat archives. The Provider's obligations as Processor remain unaffected by the Customer's responsibilities.

3.4. The Service is designed for commercial correspondence, not for the deliberate processing of special-category personal data under Article 9 GDPR or criminal-offence data under Article 10 GDPR. Such information may occur incidentally in business messages. The Customer shall assess the lawfulness of its use and any additional safeguards required; the parties shall cooperate to address material risks identified in this context.

3.5. The Provider shall not use Customer Personal Data for its own direct marketing, for another customer's purposes, or to train general-purpose AI models for purposes unrelated to the provision of the Service. The Provider shall not authorise its sub-processors to use Customer Personal Data for such unrelated model training. Any materially different use requires the Customer's prior documented instructions and a lawful basis, together with any necessary change to the contractual arrangements.

4. CONFIDENTIALITY AND PERSONNEL ACCESS

4.1. The Provider shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.2. The Provider may grant selected authorised personnel privileged technical access to Customer Personal Data through administrative tools used to operate and support the Service. Depending on their assigned responsibilities, such tools may technically permit access to Messages, attachments, extracted information and other records associated with different Organisation Accounts.

Privileged access shall be used only where necessary for legitimate operational purposes, including assisted Onboarding, Customer support, troubleshooting, verification of extraction quality, security investigations, and Customer-requested export or deletion.

The Provider shall limit such privileges to identified authorised personnel, apply appropriate confidentiality and security controls, review the continued need for privileged access and withdraw it when no longer justified. The technical ability to access Customer Personal Data does not authorise personnel to inspect or use that data for unrelated purposes.

4.3. The Provider shall review and withdraw personnel access when no longer required and shall take appropriate steps to prevent unauthorised disclosure or use of Customer Personal Data.

4.4. The Customer manages access rights of its own Users and the security of its Connected Sources. The Provider remains responsible for the access controls and security obligations assigned to it under this DPA.

4.5. The Provider shall maintain documented internal rules governing privileged administrative access to Customer Personal Data. Those rules shall address authorisation, permitted purposes of access, protection of administrative credentials, periodic permission reviews, supervision of privileged activities and investigation of suspected misuse.

The Provider shall assess and maintain appropriate logging, monitoring or other accountability measures for privileged access, taking into account the nature of the administrative tools, the sensitivity and volume of Customer Personal Data, and the risks to data subjects. Where available technical logs do not record individual access to Customer content, the Provider shall assess that limitation and maintain proportionate compensating controls until appropriate additional measures are implemented.

Technical and organisational safeguards applicable to administrative access are further described in Schedule 2.

5. SECURITY OF PROCESSING

5.1. The Provider shall implement and maintain technical and organisational measures appropriate to the risks under Article 32 GDPR, considering the nature, scope, context and purposes of processing and the risks to individuals. The measures are specified in Schedule 2.

5.2. Those measures address, as appropriate, confidentiality, integrity, availability and resilience; the ability to restore access following an incident; and procedures for assessing the effectiveness of safeguards. The Provider may replace or improve individual measures provided that the overall level of protection is not materially reduced.

5.3. The Provider shall ensure that Customer Personal Data remains logically separated between Organisation Accounts and that connected-source credentials are protected against unauthorised access.

5.4. The Customer is responsible for securing its own devices, credentials, connected email and WhatsApp accounts, and User permissions. This allocation of responsibility does not relieve the Provider of any duty imposed by the GDPR or this DPA.

6. AUTHORISED SUB-PROCESSORS

6.1. The Customer grants the Provider general written authorisation to engage the sub-processors specifically identified in Schedule 3, for the functions described there. The Provider shall maintain an up-to-date record of the identity and function of each sub-processor. A category of suppliers alone does not constitute authorisation to engage an unidentified supplier.

6.2. The Provider shall select sub-processors providing sufficient data-protection guarantees and shall impose, by a binding contract or other legal act, obligations providing at least the protection required by Article 28(4) GDPR, including confidentiality, security, assistance, deletion and appropriate transfer safeguards. The Provider remains responsible to the Customer for each sub-processor's performance of its data-protection obligations.

6.3. Before adding or replacing a sub-processor, the Provider shall actively notify the Customer's Organisation Administrator at least 15 calendar days in advance. The notice shall identify the supplier and the processing function and describe material changes to processing locations or international transfer safeguards. Merely updating a webpage without notifying the Customer does not satisfy this requirement. A shorter period may be used only where an urgent security or legal necessity requires the change; in that case the Provider shall inform the Customer as promptly as possible and explain the reason.

6.4. The Customer may object in writing within the notice period on reasonable data-protection grounds. The parties shall seek a practical resolution, including an appropriate safeguard, alternative supplier or restriction of the affected function. If the objection cannot be resolved, the Provider shall not use the proposed new sub-processor to process the objecting Customer's data without a lawful basis for doing so. Either party may terminate the affected Service where continuation is not reasonably possible; settlement of unused Purchased Credits follows the Terms.

6.5. A Connected Source separately selected and contracted by the Customer, such as its own email provider, is not automatically a sub-processor of Broker.farm. Where the Provider itself engages a third-party integration operator to process Customer Personal Data on its behalf, that operator is subject to this Section and, where acting as a sub-processor, must be identified in Schedule 3.

6.6. Authorisation under this Section does not remove the need for a valid contract, security safeguards or an international transfer mechanism before Customer Personal Data is sent to a sub-processor.

7. INTERNATIONAL TRANSFERS

7.1. The Provider shall not transfer Customer Personal Data outside the EEA in violation of Chapter V GDPR where it applies. Before making a restricted transfer, the Provider shall ensure an applicable adequacy decision, valid EU Standard Contractual Clauses with any necessary supplementary measures, or another lawful mechanism covers the relevant recipient and processing.

7.2. Safeguards shall be evaluated for the relevant recipient, contracting entity, country, access arrangements, onward transfers and categories of data. Storage in an EEA cloud region alone does not establish that all access or processing remains within the EEA.

7.3. The Provider shall ensure that its arrangements with non-EEA sub-processors include the required contractual transfer safeguards and will provide the Customer, on reasonable request, with information needed to assess transfers concerning its Customer Personal Data, subject to legitimate confidentiality and security limitations.

7.4. Where the Customer instructs the Provider to transmit information to a recipient chosen independently by the Customer, the Customer is responsible for establishing the lawfulness of that instruction and any transfer for which it is the exporter. The Provider remains responsible for its own transfers and documented-instruction duties.

7.5. This DPA governs the relationship between the Customer and the Provider under Article 28 GDPR. It does not by itself replace the separate transfer safeguards required for a restricted international transfer.

8. DATA SUBJECT RIGHTS, BREACHES, ASSISTANCE AND AUDITS

8.1. Data subject requests. Taking into account the nature of processing, the Provider shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise the rights in Chapter III GDPR. If a data subject contacts the Provider about Customer Personal Data, the Provider shall promptly refer the request to the Customer unless prohibited by law, and shall not independently decide the merits of the request.

8.2. Personal data breaches. The Provider shall notify the Customer without undue delay and, in any event, within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. The initial notification shall include the information then available concerning the nature of the breach, categories and approximate numbers of affected data subjects and records where known, likely consequences, measures taken or proposed, and a contact for follow-up. The Provider may provide the information in stages without undue further delay and shall cooperate with the Customer in investigating, containing and remediating the breach. The Customer remains responsible for its own decisions concerning notifications to authorities and data subjects.

8.3. Assistance with compliance. Taking account of the nature of processing and the information available, the Provider shall assist the Customer in meeting its obligations under Articles 32–36 GDPR, including security, breach assessment and notification, data protection impact assessments and prior consultation.

8.4. Demonstrating compliance and audits. The Provider shall make available information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it. Documentary review and remote audit may be used first where appropriate. On-site inspections may be subject to reasonable notice, confidentiality, security and scheduling safeguards, except where urgent circumstances or a supervisory authority's lawful requirement justify a different approach. Audit arrangements must protect other customers' data and not compromise the Service's security.

8.5. Costs. The parties may agree reasonable charges for customer-specific assistance beyond the Service's ordinary functionality, provided that no mandatory statutory assistance, disclosure or audit obligation is made conditional on payment.

8.6. Contact and notices. Customer incident and data-protection notices shall be sent to the Organisation Administrator or another contact designated by the Customer. Notices to the Provider, including breach reports and documented instructions, may be sent to valeriya@berrini.farm.

9. DATA RETURN, EXPORT AND DELETION

9.1. At the Customer's choice, upon the end of processing services or following a valid documented instruction, the Provider shall return or delete Customer Personal Data and delete existing copies, unless Union or Member State law requires storage. Data retrieval and switching rights under the Terms and applicable law, including the EU Data Act where applicable, shall be respected.

9.2. The Customer should initiate an export before ending access where practical. Where there is no applicable mandatory retrieval or switching period or other lawful reason to preserve data, the Provider shall delete Customer Personal Data from the active Service within 30 days of termination or receipt of a verified deletion instruction. If the Customer elects return, deletion shall follow completion of the applicable return and retrieval process, subject to mandatory law.

9.3. Copies in protected rolling backups may remain until overwritten or deleted in the documented backup retention cycle. Such copies shall be protected against routine access and use and shall not be restored to ordinary processing except as necessary for security, recovery or compliance with law. If restored, applicable deletion instructions shall be reapplied. The Provider shall not keep backup copies indefinitely.

9.4. Personal data that the Provider must retain by applicable Union or Member State law shall be restricted to the required purpose and period, and separated from ordinary processing where practicable. Processing for the Provider's independent-controller purposes, such as lawful invoice retention, is addressed in the Privacy Policy.

9.5. The Provider shall confirm completion of deletion on the Customer's reasonable request, describing any remaining legally required retention or protected backup copies. A secure, support-assisted export or deletion process may be used where direct account access cannot safely be maintained.

9.6. Retention during suspension and source disconnection. A pause in AI Analysis, exhaustion of Message Credits, marking a contact Ignored, leaving a sender unclassified or disconnecting a Connected Source does not, by itself, constitute an instruction to erase Customer Personal Data already received and stored by the Service.

Messages, attachments and associated records retained in these circumstances remain subject to the Customer's documented instructions and the applicable storage, export, retrieval and deletion provisions of this DPA and the Terms. The Provider shall not retain such information indefinitely merely because it has not been submitted for AI Analysis. Where the Agreement ends following prolonged inactivity, the return and deletion process in this Section shall apply, subject to mandatory retrieval, switching and legal-retention requirements.

9.7. Scope of deletion. Where deletion is required under this DPA, the Provider shall apply the deletion process to Customer Personal Data retained in the active Service, including received and imported Messages, associated metadata, attachments, Customer-uploaded files, extracted business records, AI-generated results containing personal data and other Customer workspace records within the scope of the deletion instruction.

The Provider shall also ensure that authorised sub-processors delete or return relevant Customer Personal Data in accordance with the applicable contractual arrangements, subject to lawful retention and technically protected backup copies governed by Section 9.3. The Provider shall not use retained backup copies to recreate a terminated Customer workspace in the ordinary course of business.

10. LIABILITY AND CHANGES

10.1. Allocation of liability between the parties is governed by Section 22 of the Terms, to the extent permitted by law. Nothing in the Terms or this DPA limits rights of data subjects, compensation rights or recourse that cannot lawfully be restricted, or the powers of a supervisory authority.

10.2. Changes to this DPA follow the notice and amendment rules in Section 18 of the Terms. Material changes affecting the protection of Customer Personal Data shall not be imposed in a manner that breaches the GDPR. Changes to sub-processors also follow Section 6 of this DPA.

10.3. The English-language version controls unless the parties expressly agree otherwise in a valid Order.

11. ELECTRONIC CONCLUSION AND EVIDENCE

11.1. Acceptance of the Terms by a person authorised to represent the Customer also constitutes acceptance of this DPA, which forms an integral part of the Agreement. The DPA is concluded electronically, as permitted by Article 28(9) GDPR.

11.2. The Provider shall maintain electronic evidence of the conclusion of the Agreement, including the identified Customer organisation and Organisation Account, the person accepting the contractual documents, the date and time and method of acceptance, and the versions of the Terms and DPA accepted. The record shall also identify the applicable Pricing Schedule presented at registration where it forms part of the Agreement.

The Customer shall be able to obtain, save and retain the contractual documents applicable at the time of acceptance. Acceptance records shall be retained for the period reasonably necessary to establish and defend the parties' contractual rights and to comply with applicable legal obligations.

SCHEDULE 1 — DETAILS OF PROCESSING

SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL MEASURES

The Provider shall implement and maintain technical and organisational measures appropriate to the risks associated with Customer Personal Data processed in Broker.farm. These measures form part of the Provider's contractual security obligations and shall be reviewed as necessary to address material changes in risks, technology or processing activities.

1. Access control and confidentiality. Access to Customer Personal Data is limited to authorised persons with legitimate operational responsibilities. Personnel are subject to confidentiality obligations. Access permissions, including privileged administrative permissions, are reviewed and withdrawn when no longer justified.
2. Organisation separation. Application permissions and data-access controls are designed to prevent Users of one Organisation Account from accessing another Customer's workspace through ordinary Service functions. Privileged Provider administration is governed separately by Section 4 and appropriate internal security controls.
3. Transport security. Communications with the Service and supported integrations use TLS or equivalent secure transport where supported and appropriate to the connection.
4. Protection of integration credentials and secrets. Stored mailbox credentials, integration tokens and comparable secrets are protected using encryption at rest, appropriate access restrictions and secure management of encryption keys. Encryption keys are managed separately from the application database to the extent required by the implemented architecture.
5. Infrastructure and file-storage security. Application databases, message content, attachments and Customer-uploaded files are protected by appropriate access restrictions and the security controls applicable to the Provider's hosting, database, file-storage and integration suppliers.
6. Backups and recovery. The Provider maintains backup and recovery arrangements appropriate to the risks of the Service. Backup access is restricted, backup retention is governed by documented retention arrangements, and recovery processes are designed to restore availability where necessary. Backup copies are handled in accordance with Section 9 of this DPA.
7. Security logging and privileged-access oversight. The Provider maintains security monitoring, relevant operational records and procedures for investigating suspected unauthorised access, misuse and security incidents. Privileged administrative access is subject to appropriate supervision, access reviews and risk-based accountability measures. Where available logs do not identify individual access to Customer content, the Provider shall assess the resulting risks and maintain proportionate compensating controls pending implementation of additional measures where required.
8. Data minimisation in AI processing. Customer Personal Data is submitted to AI sub-processors only for permitted Service functions. Messages excluded from AI Analysis by applicable Ignored-contact settings, unclassified-sender restrictions or zero-credit processing restrictions are not intentionally submitted for AI Analysis while those restrictions apply.
9. Supplier security and contractual controls. Authorised sub-processors are subject to appropriate contractual data-protection obligations, security requirements and applicable international-transfer safeguards. The Provider remains responsible for the obligations assigned to it under this DPA.
10. Data lifecycle and deletion. The Provider maintains processes for disconnecting integrations, restricting AI Analysis, managing retained Messages, handling export requests and deleting Customer Personal Data from active systems and protected backups in accordance with Section 9 and the applicable retention arrangements.
11. Security review and incident response. The Provider periodically assesses the suitability of its safeguards and addresses identified weaknesses in proportion to the risks. Security incidents and personal data breaches are handled in accordance with the Provider's documented procedures and Section 8 of this DPA.

SCHEDULE 3 — AUTHORISED SUB-PROCESSORS AND SERVICE INTEGRATIONS

The Customer authorises the suppliers identified below to process Customer Personal Data in their capacity as sub-processors for the described Service functions. Where a supplier acts as an independent controller or as a service provider contracted directly by the Customer, that separate processing is not governed by this authorisation. The Provider maintains the relevant supplier contracts and transfer safeguards required by Sections 6 and 7.

Connected Sources and WhatsApp. The Customer's independent email provider and other third-party services selected and contracted by the Customer remain subject to their own applicable terms. Meta / WhatsApp Business Platform is included above insofar as it acts as a sub-processor engaged by the Provider. The allocation of roles for a particular WhatsApp connection depends on the applicable business arrangements and Service configuration. Where Meta acts as an independent controller or as the Customer's own service provider, that processing is not authorised or governed by this DPA.
Website, sales and independent-controller suppliers. This Schedule concerns suppliers processing Customer Personal Data on the Provider's behalf in connection with the Customer-controlled Service. Suppliers used exclusively for the Provider's own website analytics, sales enquiries, meeting scheduling, payment administration or independent-controller activities are described, as appropriate, in the Broker.farm Privacy Policy and are not authorised as Customer Data sub-processors merely by being named there. If such a supplier is also engaged to process Customer Personal Data on the Provider's behalf, the Provider shall ensure that the applicable sub-processor requirements of Sections 6 and 7 are fulfilled before that processing begins.
Changes and objections: valeriya@berrini.farm.

Broker.farm — Data Processing Agreement, version 1.1.