Data Protection Addendum

---

This Data Protection Addendum ("DPA") forms part of the applicable proposal, order form, purchase order, service agreement, SLA, terms of service or other binding agreement (the "Agreement") between MasterSoft ERP Solutions Pvt. Ltd. ("MasterSoft") and the educational institution or other customer identified in the Agreement (the "Client").

The DPA applies only to Personal Data that MasterSoft Processes on behalf of the Client in providing the contracted Services. It does not replace the Client's obligations as Controller, including the obligation to establish a lawful basis, give required privacy information, obtain any legally required consent or parental/guardian authorisation, and respond to Data Subjects.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the Agreement.

2. Scope and roles of the Parties

2.1 For Client Personal Data, the Client acts as Controller. If the Client itself acts as a Processor for another Controller, the Client acts as Processor and MasterSoft acts as its Subprocessor. MasterSoft acts as Processor or Subprocessor, as applicable, and shall Process Client Personal Data only in accordance with this DPA and Documented Instructions.

2.2 The Client determines the purposes and essential means of the Processing, including what data is collected, whose data is entered, which modules and workflows are used, authorised users, retention requirements, and the lawful basis for the Processing.

2.3 MasterSoft may act as an independent Controller for limited data relating to its own business relationship with the Client, such as authorised contact details, contracting, billing, account administration, website interactions, legal compliance and security records relating to MasterSoft's own systems and business relationship (but not logs or records generated within the Client's environment that relate to Client users, which are Client Personal Data). Such processing is governed by MasterSoft's published privacy notice (including Part A of its GDPR Privacy & Data Processing Policy) and is outside the scope of this DPA.

2.4 Hosting, storage, organisation, retrieval, automated calculation, transmission, backup, recovery, support and deletion are Processing under GDPR even when MasterSoft personnel do not view the underlying Client Personal Data.

3. Client responsibilities and lawful basis

3.1 The Client is responsible for complying with its Controller obligations under Applicable Data Protection Law, including lawfulness, fairness, transparency, accuracy, purpose limitation, data minimisation, retention, rights handling and appropriate technical and organisational measures within the Client's control.

3.2 The Client shall ensure that it has all lawful bases, notices, permissions, approvals and, where legally required, consents necessary for MasterSoft to Process Client Personal Data in accordance with the Agreement.

3.3 The Client's execution of a Purchase Order, Agreement or DPA authorises and instructs MasterSoft to provide the contracted Services. It is not, and shall not be represented as, the consent of a student, employee, parent, guardian or other Data Subject.

3.4 The Client shall not instruct MasterSoft to Process Personal Data in a manner that the Client knows, or reasonably should know, violates Applicable Data Protection Law. MasterSoft shall immediately inform the Client if, in MasterSoft's reasonable opinion, a Documented Instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.

4. Children and minors

4.1 MasterSoft provides enterprise education technology to Institutions and does not independently determine why children's Personal Data is collected or used. Where the Client enters or enables Processing of Personal Data relating to children or minors, the Client remains responsible for determining the lawful basis and for satisfying any additional requirements that apply to children.

4.2 Where Applicable Data Protection Law requires consent or authorisation from a parent or lawful guardian, the Client shall obtain, record and manage that consent or authorisation before or in connection with the relevant Processing. MasterSoft does not independently seek or verify parental consent unless the Parties expressly agree to a specific functionality requiring MasterSoft to do so.

4.3 MasterSoft shall Process children's Client Personal Data only for the Client's authorised educational and administrative purposes, such as admissions, enrolment, attendance, teaching/learning administration, examinations, results, fees, communications and other contracted institutional functions.

4.4 MasterSoft shall not use children's Client Personal Data for independent behavioural advertising, data brokerage or training of any AI or machine-learning models. Requests by a child, parent or guardian are ordinarily routed to the Client, and MasterSoft shall provide reasonable assistance to the Client in responding.

5. Processing instructions and purpose limitation

5.1 MasterSoft shall Process Client Personal Data only:

• to provide, secure, maintain and support the contracted Services for the Client;

• on Documented Instructions of the Client, including with regard to transfers of Personal Data to a third country or an international organisation;

• through authorised personnel and authorised Subprocessors; and

• where required by Union or Member State law to which MasterSoft is subject, in which case MasterSoft shall inform the Client of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. Legally binding requests arising under other laws are addressed under Section 13.

5.2 MasterSoft shall not sell Client Personal Data, use it for unrelated marketing, combine it with data from other customers for independent profiling, or use it to train, fine-tune or improve any AI/LLM or machine-learning model, or to improve or develop MasterSoft's products or services or for any other purpose of its own, unless the Client has given a specific written instruction to do so.

5.3 If the Client activates an AI-enabled function that requires Processing of Client Personal Data, such Processing shall remain subject to Documented Instructions, applicable lawful basis, security controls, Subprocessor obligations and international-transfer requirements. Any third-party AI or model provider that Processes Client Personal Data is a Subprocessor subject to Section 11 and shall be identified in Schedule 3 or the Agreement, together with the location of that Processing. MasterSoft shall ensure that such a provider does not retain Client Personal Data for longer than needed to deliver the function or use it to train models, and the Client may switch the function off.

6. Confidentiality and authorised personnel

MasterSoft shall ensure that persons authorised to Process Client Personal Data are bound by contractual or statutory confidentiality obligations, receive appropriate privacy/security awareness, and access Client Personal Data only to the extent reasonably necessary for their assigned role. Access shall be role-based and subject to authentication and logging controls appropriate to the Services. Support Access (as defined in Section 7.4) is subject to Sections 7.4 to 7.9.

7. Security of Processing

7.1 Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the risks to Data Subjects, MasterSoft shall implement and maintain appropriate technical and organisational measures designed to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, including, as appropriate, pseudonymisation and encryption of Personal Data, measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, the ability to restore the availability of and access to Personal Data in a timely manner after an incident, and a process for regularly testing, assessing and evaluating the effectiveness of those measures.

7.2 The principal controls are described in Schedule 2. Security measures may evolve during the term to address new technology, threats and legal requirements, provided that MasterSoft does not materially reduce the overall level of protection applicable to the contracted Services.

7.3 Client users remain responsible for protecting their own credentials, enabling security features made available to them, maintaining accurate authorised-user records, and not sharing passwords, authentication tokens or ERP credentials with unauthorised persons or external AI/LLM tools.

7.4 Support Access and approval. "Support Access" means access by MasterSoft or Subprocessor personnel to the content of Client Personal Data for support, implementation, maintenance, security or recovery purposes. Wherever practicable, support shall be delivered without Support Access, using system metadata, diagnostic output, screen-sharing sessions controlled by the Client's own users, and masked, pseudonymised or synthetic data. Before Support Access to the content of Client Personal Data in a production environment, MasterSoft shall obtain the approval of the Client's authorised contact named in the Agreement or onboarding records. The approval shall be recorded in the support ticket or another written or electronic form and shall state the purpose, the data or modules concerned and the period of access. The Client may give standing approval for defined categories of routine tasks, may withdraw or narrow any approval at any time, and may by written instruction require approval for additional categories of data or modules or restrict Support Access to defined modules.

7.5 Emergency access. Where Support Access is necessary to respond to a security event or to restore availability and prior approval cannot reasonably be obtained, MasterSoft may proceed using the minimum access needed and shall notify the Client's authorised contact without undue delay, and in any event within twenty-four (24) hours after access begins, stating the reason, the data or systems concerned and the actions taken, unless law prohibits the notice.

7.6 Just-in-time and time-limited access. MasterSoft shall ensure that: (a) support personnel have no standing access to the content of Client Personal Data in production environments, and elevated access is activated only on request for a specific ticket and task (just-in-time access), using Azure privileged-access controls such as Microsoft Entra Privileged Identity Management or an equivalent; (b) credentials and elevated privileges expire automatically when the task ends and in any event within twenty-four (24) hours, unless the Client approves a longer period in writing; (c) multi-factor authentication is required for all remote access to production environments; (d) access is made only from managed devices through a secure access gateway hosted in the Hosting Region (such as Azure Bastion or a virtual desktop), and production databases and storage are not directly reachable by support personnel from the public internet; (e) download, clipboard copy and file transfer from gateway sessions are disabled by default, and Client Personal Data is not stored on personal or unmanaged devices, or in email, chat or ticketing tools, except where the Client has approved it for a specific task; and (f) Support Access rights are reviewed at least quarterly and removed promptly on a change of role or departure.

7.7 Access logs. MasterSoft shall log each Support Access to Client Personal Data in production environments using Azure identity, activity and audit logging (for example Microsoft Entra sign-in and audit logs, Azure Activity Logs and Azure Monitor, and database auditing where enabled), together with its ticket and approval records. The logs shall record at least the identity of the person accessing, the date, time and duration, the ticket reference and purpose, the systems or modules accessed, the type of action (such as view, modify, export or delete), the approving Client contact and the country from which access was made. Logs containing Client Personal Data shall be stored in the Hosting Region, protected against unauthorised alteration and retained for at least twelve (12) months, or longer where the Agreement or applicable law requires. On the Client's written request, MasterSoft shall provide a report of Support Access to the Client's environment within ten (10) business days, and without undue delay where the request relates to a suspected Personal Data Breach, a regulator enquiry or an audit under Section 15. MasterSoft may redact information relating to other customers or that would compromise security.

7.8 Pseudonymisation, masking and non-production data. MasterSoft shall keep non-production environments separate from production and shall use masked, pseudonymised or synthetic data in them for development, testing, training, troubleshooting and demonstrations. Production Client Personal Data shall not be copied to a non-production environment unless the Client instructs this in writing, and then only after direct identifiers and sensitive fields have been masked or pseudonymised, unless that would defeat the purpose of the task; any non-production environment holding Client Personal Data shall be in the Hosting Region. Where support personnel must view production records, MasterSoft shall configure support views to mask by default fields such as government-issued identifiers, bank or payment references, contact details, health or disability information and biometric templates, using database-level masking (such as Azure SQL Dynamic Data Masking) or equivalent application-level masking, and shall unmask a field only where needed for the approved task. Masking applies in addition to, and not instead of, the access controls in this Section 7. Special-category data, including biometric templates, shall be accessed only where strictly necessary and where the approval under Section 7.4 expressly covers it. Data in support or diagnostic extracts shall be pseudonymised where practicable and deleted when the task closes, and in any event within thirty (30) days.

7.9 Microsoft access. Where Microsoft personnel need access to content in a MasterSoft Azure environment that holds Client Personal Data, MasterSoft shall use the customer-approval controls offered by Microsoft for the Azure services concerned, such as Customer Lockbox where available, so that MasterSoft reviews each request before access is granted. Microsoft's access is otherwise governed by Section 11 and Microsoft's data protection terms with MasterSoft.

8. Personal Data Breach

8.1 MasterSoft shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data, and in any event within forty-eight (48) hours. MasterSoft is aware of a Personal Data Breach when it has a reasonable degree of certainty that a security incident has compromised Client Personal Data.

8.2 To the extent information is reasonably available, the notice shall describe the nature of the incident, categories of affected data and Data Subjects, likely consequences, measures taken or proposed, and a contact point for further information. MasterSoft may provide information in phases where all facts are not available at the time of the initial notice.

8.3 MasterSoft shall take reasonable steps to contain, investigate, mitigate and remediate the incident and shall reasonably assist the Client with the Client's notification obligations under Applicable Data Protection Law. MasterSoft shall document each Personal Data Breach, including the facts, its effects and the remedial action taken, and provide that record to the Client on request. Notification of an incident is not an admission of fault or liability.

9. Data Subject requests

9.1 Taking into account the nature of the Processing, MasterSoft shall assist the Client, by appropriate technical and organisational measures insofar as this is possible, to fulfil the Client's obligations to respond to requests for access, rectification, erasure, restriction, portability, objection and other applicable Data Subject rights.

9.2 If MasterSoft receives a request directly concerning Client Personal Data, MasterSoft shall, unless legally prohibited, refer the requester to the Client and forward the request to the Client within five (5) business days of receipt and shall not independently determine the merits of the request.

9.3 Where assistance requires material work beyond the standard functionality or support included in the Agreement, the Parties may agree reasonable professional-service charges, except where the work is required because of MasterSoft's breach of this DPA.

10. DPIAs and regulatory consultation

Taking into account the nature of Processing and information available to MasterSoft, MasterSoft shall provide reasonable assistance to the Client with data protection impact assessments and prior consultation with supervisory authorities where Articles 35 or 36 GDPR (or equivalent requirements) apply to the Client's use of the Services, and with the Client's obligations under Articles 32 to 34 GDPR.

11. Subprocessors

11.1 The Client grants MasterSoft general written authorisation to appoint Subprocessors necessary to provide the Services. MasterSoft shall enter into a written agreement with each Subprocessor that Processes Client Personal Data and shall impose data-protection obligations that are the same as those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures, as required by Article 28(4) GDPR.

11.2 MasterSoft remains fully liable to the Client for the performance of its Subprocessors' data-protection obligations.

11.3 MasterSoft shall maintain a current list of all Subprocessors, stating each Subprocessor's name, the Processing it performs and its country or region of Processing, and shall provide the Client with at least fifteen (15) calendar days' prior written notice of any intended addition or replacement of a Subprocessor, giving the Client the opportunity to object. The Client may object on reasonable and documented data-protection grounds. The Parties shall work in good faith to resolve the concern without compromising security, service availability or the rights of other customers. If the objection is not resolved within thirty (30) calendar days, MasterSoft shall not use the objected-to Subprocessor to Process the Client's Client Personal Data or, if that is not possible, the Client may terminate the affected Services by written notice and receive a pro-rata refund of prepaid fees for the period after termination, without penalty.

11.4 The current Subprocessor framework is described in Schedule 3. A listed tool is a Subprocessor only to the extent that it actually Processes Client Personal Data for the relevant Services.

12. International transfers and remote access

12.1 MasterSoft hosts Client Personal Data on Microsoft Azure in the Azure region selected for the Client in the Agreement, Order Form or service configuration (the "Hosting Region"). MasterSoft shall store Client Personal Data at rest, including backups and disaster-recovery copies, only in the Hosting Region and any secondary region identified in the Agreement or Order Form, and shall not move or replicate it to another region without prior written notice to the Client and, where the move would be a restricted transfer, a valid transfer mechanism under Chapter V GDPR. The Client acknowledges that authorised support, security, implementation or service operations from India may constitute a transfer or remote access to Client Personal Data even where the production environment is hosted in another region.

12.2 Where Chapter V GDPR restricts a transfer from the EEA to a country that is not covered by an applicable adequacy decision, the Parties shall use a lawful transfer mechanism. Where the EU SCCs are legally available and appropriate, they shall apply as described in Schedule 4, Module 2 (Controller to Processor) where the Client is a Controller, or Module 3 (Processor to Processor) where the Client is a Processor. No restricted transfer shall begin until the applicable transfer mechanism has been completed in accordance with Schedule 4 and the Acceptance section.

12.3 Where the EU SCCs are not legally available for a particular transfer, including where the relevant Processing by the importer is directly subject to GDPR in a manner for which the EU SCCs are not intended, the Parties shall, before the transfer takes place, agree in writing another transfer mechanism permitted by Chapter V GDPR (for example, any additional standard contractual clauses adopted by the European Commission for importers that are directly subject to GDPR). If no such mechanism is in place, MasterSoft shall not carry out the restricted transfer.

12.4 For restricted transfers under UK GDPR, the Parties shall use the then-current UK Addendum or IDTA, as appropriate, when required. Any mandatory approved transfer clauses prevail over conflicting provisions of this DPA.

12.5 MasterSoft shall reasonably cooperate with the Client in transfer-risk assessments and supplementary-measures reviews, taking into account the nature of the Services and the information reasonably available to MasterSoft. MasterSoft warrants that, as at the date of this DPA, it has no reason to believe that the laws and practices of India applicable to it, including requirements to disclose Client Personal Data to public authorities, prevent it from fulfilling its obligations under this DPA and the EU SCCs, and shall maintain, and provide to the Client on request, a summary of its transfer impact assessment.

12.6 Support Access from India is subject to Sections 7.4 to 7.9, which the Parties treat as supplementary technical and organisational measures that apply in addition to, and not instead of, the applicable transfer mechanism. MasterSoft shall not provide Support Access from any country other than India, the Hosting Region and the locations of Subprocessors listed under Section 11.3 without first notifying the Client.

13. Government and law-enforcement requests

Unless prohibited by law, MasterSoft shall notify the Client of a legally binding request from a public authority for Client Personal Data. MasterSoft shall review the legality of each request and shall challenge it where, after careful assessment, there are reasonable grounds to consider that it is unlawful under the law of the requesting country, applicable international law or principles of international comity, including by pursuing available appeals and seeking interim measures to suspend its effects. MasterSoft shall not disclose the data requested until required to do so under the applicable procedural rules, shall disclose only the minimum amount of data permissible on a reasonable interpretation of the request, and shall document its legal assessment and any challenge and make that documentation available to the Client on request. Where MasterSoft is prohibited from notifying the Client, it shall use its best efforts to obtain a waiver of the prohibition so that it can communicate as much information as possible as soon as possible. MasterSoft shall also notify the Client promptly if it becomes aware of any direct access by a public authority to Client Personal Data.

14. Return, deletion and backups

14.1 During the term, the Client controls ordinary retention of Client Personal Data through the Services, subject to contracted functionality, legal requirements and technical architecture.

14.2 At the end of the Services, MasterSoft shall, at the Client's choice and subject to the Agreement, return or delete Client Personal Data and delete existing copies within thirty (30) days after the Client's instruction or the end of the Services (subject to Section 14.3), and shall confirm deletion in writing on request, unless Union or Member State law requires storage. If another legally binding law requires MasterSoft to retain particular data, MasterSoft shall, unless prohibited by law, inform the Client and restrict the retained data to the required purpose and period. Export and exit procedures may be subject to agreed formats, timelines and professional services where applicable.

14.3 Operational and disaster-recovery backups may retain residual copies for a limited period of up to ninety (90) days after deletion from the active environment. Where immediate granular deletion is technically impracticable without affecting backup integrity, security or other customers, MasterSoft may isolate the residual data from ordinary use and allow it to expire through the normal protected backup lifecycle. Such backup data shall remain subject to confidentiality and security controls and shall not be restored for ordinary business use except where required for disaster recovery, security investigation or legal compliance.

15. Compliance information and audits

15.1 MasterSoft shall make available to the Client information reasonably necessary to demonstrate compliance with the obligations applicable to MasterSoft under Article 28 GDPR and this DPA. MasterSoft may satisfy this obligation initially through relevant policies, security documentation, certifications/assessments where available, questionnaire responses, audit summaries or other appropriate evidence.

15.2 MasterSoft shall allow for and contribute to audits, including inspections, conducted by the Client or an independent auditor mandated by the Client, subject to appropriate confidentiality, security, safety and non-disruption requirements. Except following a material incident, regulator request or indications of non-compliance, audits shall ordinarily be limited to once in any twelve-month period and conducted on reasonable prior written notice during normal business hours.

15.3 Audit rights do not authorise penetration testing, vulnerability scanning, automated attack simulation, credential testing, social engineering, AI/LLM testing against the live ERP, access to another customer's data, or any activity that could compromise security or service availability. Any active security testing requires MasterSoft's prior written approval of scope, method, timing and safety controls. This restriction does not remove the Client's statutory audit rights.

15.4 Each Party shall bear its own ordinary compliance costs. The Client shall bear reasonable costs of a customer-specific audit that exceeds standard evidence or support, unless the audit identifies a material breach by MasterSoft of this DPA.

15.5 MasterSoft shall maintain a record of the Processing activities it carries out on behalf of the Client as required by Article 30(2) GDPR and make it available to the Client or a supervisory authority on request, and shall cooperate on request with any competent supervisory authority in the performance of its tasks (Article 31 GDPR). Where Article 27 GDPR requires MasterSoft to designate a representative in the Union, MasterSoft shall do so and shall provide the representative's contact details to the Client on request.

16. Special-category, biometric and other sensitive data

16.1 The Services may, depending on the modules selected and the Client's configuration, Process sensitive information such as disability/accommodation data, health-related records, identity documents, financial/fee records, biometric templates or other data subject to enhanced legal protections.

16.2 The Client is responsible for determining whether such Processing is lawful and necessary, for identifying any applicable Article 9 GDPR condition, Article 10 requirement, or other legal requirement, and for configuring access and retention appropriately. MasterSoft shall Process such data only on Documented Instructions and shall apply security measures appropriate to the Services and the risk.

16.3 MasterSoft shall not introduce biometric identification or other materially higher-risk Processing for Client Personal Data as an independent purpose. Any such contracted feature shall be governed by the Agreement, Documented Instructions and any required DPIA, notice, consent or other lawful-basis requirements determined by the Client. Before MasterSoft enables a biometric or other special-category feature for a Client established in the EEA, the Client shall confirm in writing that it has identified the applicable Article 9 GDPR condition and completed any required data protection impact assessment.

17. Responsibility, liability and indemnity

17.1 Each Party is responsible for complying with the obligations imposed directly on it by Applicable Data Protection Law and this DPA.

17.2 The allocation and limitation of liability, indemnities, exclusions and remedies in the Agreement apply to this DPA to the maximum extent permitted by law. Nothing in the Agreement or this DPA limits or excludes rights or liabilities that cannot lawfully be limited, including mandatory rights of Data Subjects or supervisory authorities and any liability expressly governed by mandatory Standard Contractual Clauses.

17.3 The Client remains responsible for claims, penalties or losses to the extent arising from unlawful Client instructions, absence of a lawful basis or required notice/consent, inaccurate or unlawfully obtained data supplied by the Client, unauthorised credential sharing by Client users, or the Client's breach of Applicable Data Protection Law, subject to the Agreement and applicable law.

18. Term, precedence and changes

18.1 This DPA takes effect when incorporated into or executed with the Agreement and remains in force for so long as MasterSoft Processes Client Personal Data on behalf of the Client.

18.2 In the event of conflict concerning the Processing of Client Personal Data, the following order of precedence applies: (a) mandatory EU SCCs, UK Addendum/IDTA or other mandatory transfer clauses; (b) this DPA; and (c) the Agreement, unless the Agreement expressly provides greater protection and does not conflict with mandatory law.

18.3 MasterSoft may propose updates to this DPA to reflect changes in law, regulatory guidance, security practices or Services by giving the Client at least thirty (30) days' written notice. An update shall not reduce the level of protection for Client Personal Data and shall take effect for the Client only if the Client agrees in writing or the update is required by law. No update may modify the EU SCCs or other mandatory transfer clauses except as those instruments permit.

18.4 The governing law and dispute-resolution provisions of the Agreement apply to this DPA except to the extent mandatory transfer clauses or Applicable Data Protection Law require otherwise.

---

Schedule 1: Details of Processing

Schedule 2: Technical and Organisational Measures

The exact implementation of controls may vary by product, hosting model, customer configuration and contractual service level, but shall not reduce the overall level of protection described in this Schedule. This Schedule describes the baseline framework and does not replace customer-specific security commitments expressly agreed in writing.

Schedule 3: Subprocessor Framework

MasterSoft may use the following providers/categories where required for the contracted Services. The exact providers used for a Client depend on the hosting and service configuration. A provider is a Subprocessor only to the extent it Processes Client Personal Data on MasterSoft's behalf.

MasterSoft shall maintain a current list of all Subprocessors that Process Client Personal Data, stating each Subprocessor's legal entity, purpose and country or region of Processing, and shall make it available to the Client on request. Client objections are handled under Section 11.3.

Schedule 4: EU / UK International Transfer Terms

A. EU SCCs. Where a restricted EEA transfer requires the EU SCCs and the EU SCCs are legally available for the transfer, the EU SCCs are incorporated by reference into and form part of this DPA; the Parties' signature or acceptance of this DPA (or of the Agreement that incorporates it) constitutes signature of the EU SCCs and their Annexes; and the EU SCCs shall be completed as follows unless the Parties agree otherwise in writing:

• Module 2 applies where the Client is a Controller and MasterSoft is the Processor; Module 3 applies where the Client is a Processor and MasterSoft is a Subprocessor.

• The data exporter is the Client identified in the Agreement. The data importer is MasterSoft ERP Solutions Pvt. Ltd., Plot No. 8B-1, Sector 21, Non-SEZ, MIHAN, Nagpur - 441108, India; privacy contact: [email protected]; data protection officer: Amit Barapatre. The Client's contact details and role (Controller or Processor) are those stated in the Agreement, and MasterSoft's role is Processor or Subprocessor, as applicable (Annex I.A).

• Annex I.B (description of the transfer) is set out in Schedule 1; Annex II (technical and organisational measures, including measures to ensure the security of the data) is set out in Schedule 2; and Annex III (list of Subprocessors) is set out in Schedule 3 and the current Subprocessor list maintained under Section 11.3.

• Clause 7 (docking clause) applies. For Clause 9, Option 2 (general written authorisation) applies with the fifteen (15) calendar day notice period in Section 11.3.

• Clause 11 (optional redress with an independent dispute-resolution body) does not apply unless the Parties expressly agree otherwise.

• For Clause 13 and Annex I.C, the competent supervisory authority is the supervisory authority of the EU Member State in which the Client is established or, where the Client is not established in the EU but is subject to Article 3(2) GDPR, of the Member State in which its representative is established or in which the Data Subjects are located, as identified in the Agreement.

• For Clauses 17 and 18, the governing law and courts are those of the EU Member State in which the data exporter is established, provided that such law permits third-party beneficiary rights under the SCCs; otherwise the law and courts of Ireland apply. A different legally valid selection expressly stated in the Order Form prevails.

• If the SCCs require information not contained in this DPA, the Parties shall complete that information before any restricted transfer begins. The SCCs prevail over conflicting terms.

B. Transfer impact assessment. Each Party shall provide information reasonably available to it that is necessary for a transfer-risk assessment. MasterSoft shall maintain appropriate supplementary technical, contractual or organisational safeguards where required by applicable law and reasonably appropriate to the relevant transfer. MasterSoft shall apply the supplementary measures in Sections 7.4 to 7.9 and Section 13 to transfers and remote access from India, and the transfer impact assessment referred to in Section 12.5 shall address Indian law and practice on public-authority access to data.

C. UK transfers. Where a restricted transfer under UK GDPR requires an approved transfer mechanism, the Parties shall execute or incorporate the then-current ICO-approved UK Addendum to the EU SCCs or the UK IDTA, as appropriate. Mandatory approved clauses shall not be modified except as expressly permitted by those instruments.

Acceptance

This DPA may be executed as a standalone document or incorporated by reference into the Agreement, Purchase Order, Order Form or other binding instrument. Electronic signatures and counterparts are permitted to the extent recognised by applicable law. If no separate signature is used, the Client's execution or acceptance of an Agreement that expressly incorporates this DPA constitutes acceptance of these terms. Where the EU SCCs, UK Addendum/IDTA or another mandatory transfer instrument requires completion of additional annex information or execution formalities, the Parties shall complete those requirements before the relevant restricted transfer begins, and no restricted transfer shall begin until they are complete.

Data Protection Contact

Data Protection Officer: Amit Barapatre | Email: [email protected] | MasterSoft ERP Solutions Pvt. Ltd., Plot No. 8B-1, Sector 21, Non-SEZ, MIHAN, Nagpur - 441108, India.