Data Processing Agreement DPA

1Definitions

For the purposes of this Data Processing Agreement ("DPA"), the definitions set out in the LGPD (Law No. 13,709/2018) apply, without prejudice to the following:

• Personal Data: information related to an identified or identifiable natural person, pursuant to Art. 5, I, of the LGPD.
• Sensitive Personal Data: data concerning racial or ethnic origin, religious belief, political opinion, health, sex life, or genetic or biometric data, pursuant to Art. 5, II, of the LGPD.
• Data Subject: the natural person to whom the Personal Data processed under this DPA relates.
• Controller: the CLIENT, to whom the decisions regarding the processing of Personal Data belong, pursuant to Art. 5, VI, of the LGPD.
• Operator: TESS, which processes Personal Data on behalf of the Controller, pursuant to Art. 5, VII, of the LGPD.
• Processing: any operation carried out with Personal Data, pursuant to Art. 5, X, of the LGPD — collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, control, modification, communication, transfer, dissemination or extraction.
• Security Incident: any adverse event, confirmed or suspected, related to a breach of Personal Data security, including unauthorized access, leakage, alteration, or accidental or unlawful loss.
• Sub-processor: a third party engaged by the Operator to carry out, in whole or in part, Personal Data processing activities on behalf of the Controller.
• ANPD: Brazil's National Data Protection Authority.
• Applicable Data Protection Laws: all legislation, regulations and rules applicable to the protection of personal data, including, as applicable, the LGPD, the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other related rules.
• Controller Data: all data, content, files, information, prompts, outputs, logs and metadata submitted, stored, processed or generated in the context of the services, including Personal Data.
• Affiliate: any entity that controls, is controlled by, or is under common control with, one of the Parties.
• Data Subject Request: any request made by a Data Subject related to the exercise of their legal data protection rights.
• Standard Contractual Clauses (SCCs): clauses approved by regulatory authorities to legitimize international data transfers.

2Purpose and Object

2.1The purpose of this DPA is to govern the conditions under which the OPERATOR will process Personal Data on behalf of the CONTROLLER, within the scope and for the purposes of performing the Main Agreement, in compliance with Applicable Law.

2.2This DPA is an integral and inseparable part of the Main Agreement, applying to any and all processing of Personal Data carried out by the OPERATOR in connection with the provision of the contracted services.

2.3The purpose of the processing is strictly limited to the performance of the object of the Main Agreement. The OPERATOR may not process Personal Data for any other purpose, whether its own or a third party's, including for training, development, tuning or improvement of artificial intelligence models, algorithms or automated solutions, unless the CONTROLLER has given prior, express and documented authorization.

2.4In the event of a conflict between this DPA and the Main Agreement, with respect to obligations relating to the protection of Personal Data, the provisions of this DPA shall prevail.

3Roles of the Parties

3.1The CONTROLLER acts as controller of the Personal Data processed under this DPA, and is responsible for the decisions regarding the purpose and means of the processing.

3.2The OPERATOR acts as operator of the Personal Data, carrying out the processing exclusively on behalf of, and in accordance with, the documented instructions of the CONTROLLER, except where Applicable Law imposes a different obligation on the OPERATOR, in which case it must notify the CONTROLLER in advance, unless such notification is prohibited on grounds of substantial public interest.

3.3Should the Parties identify, during contract performance, a scenario of joint controllership or of the OPERATOR acting as an independent controller for its own purposes, such condition must be expressly agreed upon in a specific addendum, with the operator regime provided for in this DPA applying until then.

4Description of the Processing

4.1The characteristics of the Personal Data processing subject to this DPA, including categories of data subjects, categories of data, purposes, operations performed, duration, frequency, and systems and environments involved, are described in Annex I, which shall be completed and kept up to date by the OPERATOR, with validation by the CONTROLLER.

4.2Any material change to the scope of the processing described in Annex I must be communicated to the CONTROLLER in advance, and may not be implemented without the corresponding update to this Annex and, where required by Applicable Law, without the CONTROLLER's authorization.

5Obligations of the Operator

The OPERATOR undertakes to:

5.1process Personal Data exclusively in accordance with the documented instructions of the CONTROLLER and for the purposes set out in this DPA and in the Main Agreement;

5.2ensure that persons authorized to process Personal Data are subject to a confidentiality commitment, whether contractual or statutory in nature;

5.3adopt the technical and administrative information security measures set out in Annex II, compatible with the nature, scope, size and risk of the processing carried out;

5.4assist the CONTROLLER, to the extent reasonable and technically feasible, in responding to data subject requests and complying with obligations under Applicable Law, including the preparation of impact assessments, when applicable;

5.5notify the CONTROLLER, without undue delay, of any Security Incident that may pose a relevant risk or harm to Data Subjects, pursuant to Clause 11 of this DPA;

5.6not carry out any international transfer of Personal Data without complying with Clause 9 of this DPA;

5.7not subcontract the processing of Personal Data to Sub-processors without complying with Clause 8 of this DPA;

5.8delete or return the Personal Data upon termination of the services, in accordance with the CONTROLLER's instructions and the terms of Clause 14 of this DPA, except where retention is legally or regulatorily required;

5.9make available to the CONTROLLER the information necessary to demonstrate compliance with the obligations set out in this DPA, including, where applicable, evidence of certifications, audit reports or equivalent documentation.

6Obligations of the Controller

The CONTROLLER undertakes to:

6.1provide lawful, clear and documented instructions to the OPERATOR regarding the processing of Personal Data;

6.2ensure that it has an adequate legal basis for the processing of Personal Data and for sharing it with the OPERATOR, pursuant to Applicable Law;

6.3respond, to the extent it is responsible, to Data Subject requests related to the exercise of their rights under Applicable Law;

6.4inform the OPERATOR, in a timely manner, of any material change that may impact the processing of Personal Data subject to this DPA.

7Technical and Administrative Security Measures

7.1The OPERATOR shall adopt, where applicable to the nature, scope, size and risk of the processing, technical and administrative measures compatible with good information security practices, as detailed in Annex II of this DPA, which distinguishes mandatory minimum controls from additional controls applicable depending on the risk involved.

7.2Certifications, seals, attestations of compliance or audit reports that may be maintained by the OPERATOR (such as ISO 27001, SOC 2 or equivalents) shall be disclosed in Annex II, when available, and may be requested as supplementary evidence of compliance, without prejudice to the adoption of the minimum controls set out in this DPA.

7.3The CONTROLLER may, upon prior and reasonable notice, request additional information about the security measures adopted by the OPERATOR, subject to Clause 12 (Audit and Right of Oversight).

8Subcontracting / Sub-processors

8.1The OPERATOR may subcontract Sub-processors for the processing of Personal Data, under a general authorization from the CONTROLLER, hereby expressly granted with respect to the Sub-processors listed in the list published on the TESS Trust Center, provided that: (i) it keeps that list up to date and publicly accessible; (ii) it notifies the CONTROLLER in advance of any addition, replacement or removal of a Sub-processor, with at least 15 (fifteen) calendar days' notice; and (iii) it ensures the CONTROLLER's right to object, in a reasoned manner and in writing, within that period, to the engagement of a given Sub-processor. Upon a reasoned objection, the Parties will negotiate in good faith, for up to 30 (thirty) calendar days, a technically reasonable alternative; if no agreement is reached, the CONTROLLER may terminate, without cost or penalty, the services specifically affected by the objected subcontracting, with the Main Agreement remaining in full force with respect to the other services.

8.2The OPERATOR remains fully liable to the CONTROLLER for its Sub-processors' compliance with the obligations set out in this DPA, and must contractually impose on them data protection obligations equivalent to those established herein.

8.3The engagement of a Sub-processor for purposes of training artificial intelligence models, or that involves sharing Personal Data for such purpose, shall require the CONTROLLER's prior, express and specific authorization, and the general authorization set out in item 8.1 shall not apply in this case.

9International Data Transfer

9.1The CONTROLLER acknowledges that the provision of the services inherently involves, due to its nature and architecture, international transfer of Personal Data, and hereby expressly authorizes transfers to the countries, for the purposes, and to the Sub-processors described in Annex I and in the list of Sub-processors published on the Trust Center, which constitute, for all purposes of this Clause, valid and sufficient prior notice. Transfers to countries or sub-processors not described in Annex I or in that list shall depend on prior notice to the CONTROLLER, in the manner set out in Clause 8.1, and on the adoption of the mechanisms required by Applicable Law, including, where relevant, standard contractual clauses, adequacy decisions or other instruments recognized by the competent authority.

9.2Where required by Applicable Law or necessary for the legitimacy of the international transfer, the Parties will adopt the appropriate contractual, regulatory and technical mechanisms, including standard contractual clauses or other instruments recognized by the ANPD or by a competent foreign authority, as applicable.

9.3In the event of an international transfer of Personal Data, the OPERATOR shall disclose in Annex I and/or in the list of Sub-processors published on the Trust Center, prior to the start of the processing or any material change thereto:

a)the destination countries or international organizations;

b)the categories of Personal Data involved;

c)the purpose of the transfer;

d)the sub-processors involved, if any; and

e)the legal, technical and organizational safeguards adopted, pursuant to Applicable Law.

9.4In the absence of an international data transfer within the scope of the services, this Clause shall have no practical effect, and Annex I shall expressly indicate "not applicable".

10Data Subject Rights

10.1The OPERATOR shall assist the CONTROLLER, within a reasonable time, through appropriate technical and organizational measures, in responding to Data Subject requests relating to the exercise of their rights under Applicable Law, such as confirmation of processing, access, correction, anonymization, deletion, portability and information about data sharing.

10.2Should the OPERATOR directly receive a Data Subject request related to Personal Data processed on behalf of the CONTROLLER, it shall forward it to the CONTROLLER within 5 (five) business days, unless a shorter period is necessary for the CONTROLLER to meet an applicable legal or regulatory deadline, refraining from responding directly to the Data Subject, unless otherwise instructed by the CONTROLLER.

11Security Incident Notification

11.1The OPERATOR shall notify the CONTROLLER, within 24 (twenty-four) hours of becoming aware, of any Security Incident that may pose a relevant risk or harm to Data Subjects, providing, to the extent possible, information about the nature of the incident, the categories and approximate number of Data Subjects and records affected, the possible consequences, and the measures adopted or proposed to mitigate the risks.

11.2The OPERATOR shall cooperate with the CONTROLLER to determine the causes of the Security Incident, adopt corrective measures and, where applicable, support any obligations to notify the ANPD and the affected Data Subjects.

11.3The Parties shall designate a specific communication channel for notifying Security Incidents. The OPERATOR's channel is listed in Annex I.

12Audit and Right of Oversight

12.1The CONTROLLER may, upon prior written notice of at least 15 (fifteen) calendar days and subject to confidentiality and operational continuity safeguards for the OPERATOR, conduct audits or inspections aimed at verifying compliance with the obligations set out in this DPA, either directly or through an independent third party appointed by it, which may not be a competitor of the OPERATOR and must sign a confidentiality undertaking in the OPERATOR's favor. Audits shall be limited to a maximum frequency of once every 12 (twelve) months, shall be conducted on business days and during business hours, without interrupting the OPERATOR's operations, and shall be at the CONTROLLER's expense. This frequency limitation does not apply in the event of a confirmed Security Incident affecting the CONTROLLER or well-founded evidence of non-compliance with this DPA, in which case the audit may be conducted at any time, upon 5 (five) business days' notice.

12.2Alternatively, the OPERATOR may provide the CONTROLLER with independent audit reports, certifications or equivalent compliance questionnaires, which the CONTROLLER may accept in full or partial substitution for an on-site audit, at the CONTROLLER's discretion.

12.3The OPERATOR shall grant the CONTROLLER reasonable access to the information strictly necessary to verify compliance with this DPA, safeguarding confidential information belonging to third parties and to other clients of the OPERATOR.

12.4Should non-conformities be identified during an audit, the OPERATOR shall present the CONTROLLER with a corrective action plan within 15 (fifteen) calendar days of receiving the final report, with designated owners and deadlines for each measure.

13Confidentiality

13.1The OPERATOR undertakes to maintain confidentiality over all Personal Data and other confidential information to which it has access under this DPA, and may not disclose, assign or use it for any purpose other than that set out in this DPA and in the Main Agreement.

13.2The confidentiality obligations set out in this Clause supplement, without prejudice to, and do not exclude, any specific confidentiality obligations already set out in the Main Agreement.

14Term, Retention and Deletion of Data

14.1The OPERATOR's processing of Personal Data shall remain in effect throughout the term of the Main Agreement, automatically ending upon its termination, except where retention is legally or regulatorily required, or necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings.

14.2Upon termination of the services, the OPERATOR shall, in accordance with the CONTROLLER's instructions, return or delete all Personal Data processed under the Main Agreement, including any copies, within the period indicated in Annex I or, in the absence of such indication, within 30 (thirty) days of the end of the services.

14.3Any backup copies containing Personal Data may be deleted according to the OPERATOR's regular backup retention cycle, provided that, during that period, the data remains protected and inaccessible for any purpose other than disaster recovery.

15Liability and Indemnification

15.1Each Party shall be liable for the damages it causes to Data Subjects or to the other Party as a result of non-compliance with the obligations set out in Applicable Law or in this DPA, in proportion to its respective involvement in the processing that gave rise to the damage.

15.2Subject to the limit set out in Clause 15.3, the OPERATOR shall indemnify and hold the CONTROLLER harmless from any losses, damages, fines or administrative sanctions imposed by a competent authority that are proven to result from an act or omission of the OPERATOR or its Sub-processors in breach of this DPA or of Applicable Law.

15.3The OPERATOR's aggregate liability arising from or related to this DPA, combined with liability arising from the Main Agreement, is limited to the liability cap set out in the Main Agreement or, in the absence of a specific provision, to the total amount actually paid by the CONTROLLER to the OPERATOR in the 12 (twelve) months preceding the event giving rise to liability. This limitation does not apply, and the breaching Party shall be liable without limitation, in cases of willful misconduct, gross negligence, deliberate breach of confidentiality obligations and other legally non-waivable situations.

15.4Should the Parties adopt a specific liability limit for this DPA, such limit shall be indicated in Annex I or in a dedicated addendum to the Main Agreement.

15.5Neither Party shall be liable to the other for lost profits, loss of revenue, loss of business opportunity or indirect damages, except in legally non-waivable situations and for damages caused directly to Data Subjects.

16General Provisions

16.1This DPA binds the Parties and their successors of any kind, and assignment of contractual position is prohibited without the other Party's prior consent, except for an assignment resulting from a corporate transaction that does not materially change the conditions of Personal Data processing.

16.2A Party's tolerance of any breach of an obligation set out in this DPA shall not constitute novation, waiver or amendment of the provisions set out herein.

16.3Should any provision of this DPA be deemed null, invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the Parties shall replace the affected provision with another that, to the greatest extent possible, preserves the Parties' original intent.

16.4This DPA may be updated at any time, by means of a written addendum signed by both Parties, particularly due to changes in Applicable Law or in ANPD guidance.

17Governing Jurisdiction

17.1The jurisdiction set out in the Main Agreement shall be elected to settle any disputes arising from this DPA. In the absence of a specific provision in the Main Agreement, the courts of the Capital District of the State of Rio de Janeiro/RJ are elected, with the Parties waiving any other jurisdiction, however privileged it may be.

IAnnex I — Detailed Description of the Processing

IIAnnex II — Minimum Required Security Measures

The OPERATOR shall adopt, at a minimum, the mandatory minimum controls listed below. The additional controls shall be adopted whenever the processing involves access to critical systems, large volumes of data, Sensitive Personal Data or information technology services, as applicable, as indicated by the OPERATOR and validated by the CONTROLLER.

Mandatory minimum controls (applicable to every Operator)

• Individualized access to systems, with sharing of credentials prohibited;
• Use of strong passwords and, where technically available, multi-factor authentication (MFA);
• Access control based on the principle of least privilege necessary to perform the activities;
• Contractual confidentiality commitment and guidance for individuals with access to Personal Data;
• Maintenance of up-to-date devices, operating systems and software;
• Adoption of protection mechanisms against malicious software and unauthorized access;
• Notification of Security Incidents to the CONTROLLER within 24 (twenty-four) hours of becoming aware;
• Secure disposal or return of Personal Data upon termination of the processing, pursuant to Clause 14;
• Appropriate management of Sub-processors, where applicable, pursuant to Clause 8.

Additional controls (depending on risk, criticality and applicability)

• Encryption of Personal Data in transit and at rest;
• Generation, retention and monitoring of system access and usage logs;
• Periodic security testing, vulnerability scanning and patch management;
• Use of threat detection and response solutions (EDR/SIEM or equivalent);
• Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), with defined RTO and RPO;
• Recognized certifications (e.g., ISO/IEC 27001, SOC 2 or equivalent), when available;
• Independent information security audits;
• Periodic access reviews and timely deactivation of unused access.

Controls actually adopted by Tess

@Contact and Data Protection Officer