Data Processing Agreement — Cover Page

Provider (Processor): Kraken Services LLC, d/b/a Service Velocity *(confirm with counsel)* Common Paper DPA Standard Terms: Version 1.1 — https://commonpaper.com/standards/data-processing-agreement/1.1 Draft status: Requires counsel review — complete SCC annexes for EU/UK customers before execution

This DPA has two parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at https://commonpaper.com/standards/data-processing-agreement/1.1 ("DPA Standard Terms"), which are incorporated by reference.

If there is any inconsistency between the parts of the DPA, the Cover Page controls over the DPA Standard Terms.

*Common Paper DPA is licensed under CC BY 4.0.*

Agreement

This DPA supplements the Cloud Service Agreement (Common Paper CSA Framework Terms + Order Form) between Provider and Customer dated _______________ ("Agreement").

Approved Subprocessors

(x) List of Subprocessors available at:

• Authoritative list: subprocessor-exhibit.md
• Public URL (when published): /legal/subprocessors

Provider will give Customer 30 days' notice of material additions or replacements of Subprocessors. Customer may object on reasonable data-protection grounds within 14 days of notice. If parties cannot resolve the objection, Customer may terminate the affected services upon written notice.

Provider Security Contact

Email: security@servicevelocity.ai Postal: *(TBD — insert registered business address)*

Security Policy

(x) As defined in the Agreement (CSA Key Terms — commercially reasonable security).

Changes to the Agreement

#### DPA Covered Claim (optional — counsel to elect)

(x) The Agreement includes an additional Provider Covered Claim for any action, proceeding, or claim arising out of or relating to (1) Provider's breach or alleged breach of this DPA, or (2) Provider's gross negligence or willful misconduct, in each case, that results in a Security Incident affecting Customer Personal Data.

#### DPA Liability Cap (optional — counsel to elect)

( ) Separate Increased Cap for DPA Covered Claims: greater of $________ or ___× Fees (x) No separate DPA cap — DPA Covered Claims subject to General Cap and Increased Cap in CSA Framework Terms unless counsel adds supercap

Governing Law and Chosen Courts (DPA-specific)

( ) Notwithstanding the Agreement, DPA disputes governed by: _______________ (x) Same as Agreement — Delaware law; New Castle County, Delaware courts

Service Provider Relationship (CCPA)

(x) To the extent the California Consumer Privacy Act (CCPA/CPRA) applies, Provider is a service provider receiving Personal Data from Customer to provide the Cloud Service as agreed in the Agreement. Provider will:

• Process Personal Data only to provide the Service and as permitted by the Agreement and Applicable Data Protection Laws
• Not sell or share Personal Data provided by Customer
• Not retain, use, or disclose Personal Data except as necessary to perform the Service or as permitted by law
• Notify Customer if Provider can no longer meet these obligations

Restricted Transfers (EU/UK — complete when applicable)

Governing Member State (EEA): _______________ *(e.g., Ireland — counsel to select)* UK transfers: ☐ England and Wales ☐ Scotland ☐ Northern Ireland

*Complete Annex I–III per Common Paper DPA Standard Terms when Customer is in EEA/UK.*

*Full annex language per Common Paper DPA 1.1 — counsel to finalize.*

Exhibit: Subprocessor List