Data Processing Agreement

1. Parties, Role and Definitions

This Data Processing Agreement ("DPA") forms part of the agreement between CEXRES AI Limited (Hong Kong), acting as data processor or, where it determines the purposes and means of processing, data controller ("CEXRES", "we", "us"), and the customer or data subject ("you"). Contact details and placeholders for registration information: CEXRES AI Limited, [REGISTERED ADDRESS — to be provided], Hong Kong. Company registration number: [COMPANY REGISTRATION NUMBER — to be provided by CEXRES].

Where CEXRES processes personal data on behalf of a business customer to provide the services, CEXRES acts as processor and the customer acts as controller. Where a visitor or end-user interacts directly with our website and marketing, CEXRES acts as controller as described in the Privacy Policy. Capitalised terms used here follow their meaning in the GDPR (Regulation (EU) 2016/679), the UK GDPR, the EU/UK Standard Contractual Clauses, the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and the Singapore Personal Data Protection Act 2012 ("PDPA").

2. Scope and Processing Details

This DPA governs processing of personal data carried out in providing the CEXRES platform, including account registration, AI brand diagnosis, report generation, billing and payment, customer support, security and service communications.

Subject matter: delivery of Results-as-a-Service (RAAS™) diagnostics, reports, AI work sessions and related platform functions. Duration: for the duration of the service relationship plus the retention periods set out in the Privacy Policy. Categories of data subjects: customer representatives, end-users, account holders, and visitors. Categories of personal data: identity and contact details (name, email), account and billing identifiers, usage and diagnostic inputs, device/technical data, and payment data handled by our payment processors (CEXRES does not store full card numbers).

Processing purposes are limited to providing, securing, billing and supporting the services, and obligations on the processor include: processing only on documented instructions; ensuring personnel are bound by confidentiality; implementing the security measures in section 7; using sub-processors only under the conditions in section 5; assisting with data subject requests and security incidents; and, on termination, deleting or returning personal data subject to legal retention requirements.

3. Data Subject Rights

We support the rights granted to data subjects under the GDPR/UK GDPR, CCPA/CPRA and PDPA. Depending on the applicable law and subject to exemptions, data subjects may request to:

• Access and obtain a copy of their personal data (right of access / right to know).
• Rectify inaccurate or incomplete personal data.
• Erase personal data in the circumstances set by law ("right to be forgotten").
• Restrict or limit processing in specified circumstances.
• Object to processing based on legitimate interests and to direct marketing.
• Receive data in a structured, machine-readable format and transmit it to another provider (data portability), where technically feasible.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing; and lodge a complaint with a supervisory authority.
• For CCPA/CPRA: know, delete, correct, opt out of sales/sharing of personal information, and not be discriminated against for exercising rights. CEXRES does not sell personal information in the conventional sense and does not discriminate against consumers who exercise their rights.

4. Controller and Processor Obligations

The customer, as controller, is responsible for having a lawful basis for processing, for providing required privacy notices to end-users, and for the accuracy and lawfulness of any data it inputs into the platform. CEXRES, as processor, processes that data only to provide the service and as required by law, and will, where feasible and legally permitted, assist the controller with data protection impact assessments, prior consultation, breach notification and data subject requests, taking into account the nature of processing.

CEXRES will notify the controller without undue delay after becoming aware of a personal data breach, and provide reasonable information needed to meet the controller’s notification obligations. CEXRES requires persons acting under its authority who have access to personal data not to process it except on instructions, unless required by law.

5. Sub-Processors

CEXRES uses the sub-processors listed below to provide and support the services. The customer is deemed to authorise these sub-processors as of the effective date. CEXRES provides notice of changes by updating this list; enterprise customers with a written DPA may object on reasonable data-protection grounds within 30 days by contacting privacy@cexres.com. Current list (last reviewed October 12, 2026):

6. International Data Transfers

Personal data may be processed in countries other than the country in which it was collected. Where personal data protected by EU/UK law is transferred outside the European Economic Area, the United Kingdom or an adequacy-recognised territory, the parties rely on the European Commission Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two for controller-to-processor and, where relevant, Module Three for processor-to-processor), together with the UK International Data Transfer Addendum where applicable, and appropriate supplementary measures.

Transfers under CCPA/CPRA and PDPA are handled with comparable contractual and security safeguards, and consent or notification is provided where the local statute requires. A copy of the relevant transfer mechanism can be requested from privacy@cexres.com.

7. Security Measures

CEXRES implements technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; access controls on a least-privilege and need-to-know basis; isolated payment handling by PCI-aware processors; logging, monitoring and rate limiting; hardened HTTP security headers and Content-Security-Policy; regular reviews and patches; and documented incident-response procedures. The precise controls are kept under review and are described at a level that does not disclose sensitive security information.

8. AI-Generated Content and Accuracy

The platform uses artificial intelligence to generate diagnoses, scores, summaries, reports and recommendations. AI outputs can be incorrect, incomplete, outdated or biased and should be treated as decision support rather than definitive professional advice. CEXRES does not guarantee the accuracy, completeness or fitness for a particular purpose of AI-generated content, and the customer remains responsible for verifying outputs before relying on them and for decisions made using them. AI processing is not a substitute for legal, financial, medical or other regulated professional advice.

Inputs provided to the AI are processed to deliver the requested output and to maintain service quality, in accordance with this DPA and the Privacy Policy. Automated outputs are reviewed within the platform workflow where required; please contact us if you require human review of a specific output.

9. Retention, Deletion and Governing Terms

Personal data is retained only as long as necessary for the purposes described, to comply with legal, tax, accounting and dispute-resolution obligations, and as set out in the Privacy Policy. On termination, CEXRES deletes or returns personal data as agreed, subject to retention required by law. This DPA is read together with the Privacy Policy, Cookie Policy and Terms of Service; in the event of conflict on data-protection matters, this DPA prevails for customer-controller processing.

10. Contact

For data protection questions, DPA requests, sub-processor objections or data subject requests, contact: privacy@cexres.com. Security vulnerability reports should follow the instructions at https://cexres.com/.well-known/security.txt (security@cexres.com). CEXRES AI Limited (Hong Kong) — [REGISTERED ADDRESS — to be provided]. Company registration number: [COMPANY REGISTRATION NUMBER — to be provided by CEXRES].