Third-Party Data Sharing Disclosure

AQNOVA MARKETPLACE

Global Legal Footer Framework

Comprehensive Compliance & Platform Governance Reference

(MASTER)

GDPR Article 28 | UK GDPR | CCPA/CPRA Service Provider | LGPD | PDPA | POPIA | NDPR | Global Data Processing Requirements — Standard Form for Vendors & Business Partners

Effective Date: April 7, 2026 | Version 1.0 | Arivon Holding Corporation

AqNova's Data Processing Agreement establishes the legal framework for any situation in which a third party processes personal data on behalf of Arivon Holding Corporation (as controller), or in which Arivon Holding Corporation processes personal data on behalf of a business customer (as processor). It reflects the requirements of GDPR Article 28, UK GDPR Article 28, CCPA/CPRA service provider agreement obligations, LGPD operator agreement requirements, and equivalent data processing contract requirements across all operating jurisdictions.

7.7.1 Legal Basis — Why a DPA Is Required

GDPR Article 28(3) requires that processing by a processor shall be governed by a contract or other legal act in writing. The contract must set out the subject-matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. The seven mandatory obligations of the contract are set out in GDPR Article 28(3)(a)–(h).

GDPR Article 28(9) confirms that the contract referred to in Article 28(3) must be in writing, including in electronic form. AqNova's DPA is provided in electronic form via AqNova's legal portal and may be executed electronically.

A. Consequences of No DPA

Processing personal data without a GDPR Article 28-compliant DPA is itself a GDPR violation. Under GDPR Article 83(4), violations of Article 28 obligations are subject to administrative fines of up to EUR 10,000,000 or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. Supervisory authorities have enforced Article 28 non-compliance across the EU.

B. Controller vs. Processor — AqNova's Position

AqNova's data processing role depends on the specific activity:

AqNova as controller: in the vast majority of its activities, AqNova determines the purposes and means of processing personal data of its users (Buyers and Vendors). AqNova is the controller for processing Buyer and Vendor account data; transaction data; behavioral analytics; fraud detection; and Platform operations.

AqNova as processor: where AqNova processes personal data on behalf of a business customer (e.g., where a large retailer or brand uses AqNova's Platform to process orders for their own customers), AqNova may act as a processor for that business customer's personal data.

Joint controllership: in some contexts — for example, where AqNova and a Vendor jointly determine the purposes of processing for a co-marketing activity — AqNova and the Vendor may be joint controllers, requiring a joint controller arrangement under GDPR Article 26.

7.7.2 Scope — Who Needs a DPA with AqNova

AqNova requires a DPA with all of the following categories of parties:

7.7.3 Core DPA Terms — GDPR Article 28(3) Requirements

GDPR Article 28(3)(a)–(h) mandates that the DPA contract includes the following obligations on the processor. AqNova's standard DPA includes all eight required provisions:

A. Processing Only on Documented Instructions (Article 28(3)(a))

28(3)(a) The processor shall process personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

AqNova's DPA implementation: the processor undertakes to process personal data only pursuant to AqNova's documented instructions as set out in the DPA and any supplementary instruction schedules. Where applicable law requires processing contrary to AqNova's instructions, the processor must notify AqNova before processing (unless prohibited by law). The processor confirms it has no reason to believe that applicable law prevents it from fulfilling this instruction obligation.

B. Confidentiality Obligations (Article 28(3)(b))

28(3)(b) The processor shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

AqNova's DPA implementation: the processor undertakes that all personnel authorized to process AqNova's personal data are subject to appropriate confidentiality obligations (contractual or statutory) and have received data protection training relevant to their processing activities. Access to personal data is limited to personnel who need it for the purposes of providing the contracted services.

C. Security of Processing (Article 28(3)(c) + Article 32)

28(3)(c) The processor shall take all measures required pursuant to Article 32 (security of processing).

AqNova's DPA implementation: the processor implements and maintains appropriate technical and organizational security measures as specified in Annex B to the DPA (Section 7.7.16). Article 32 requires that security measures take into account: (a) the state of the art; (b) the costs of implementation; (c) the nature, scope, context, and purposes of processing; and (d) the risk of varying likelihood and severity of harm to individuals. AqNova's minimum required security measures are specified in Annex B.

D. Sub-Processing (Article 28(3)(d))

28(3)(d) The processor shall respect the conditions referred to in paragraphs 2 and 4 for engaging another processor.

AqNova's DPA implementation: see Section 7.7.4 below.

E. Assistance with Data Subject Rights (Article 28(3)(e))

28(3)(e) The processor shall, taking into account the nature of the processing, assist the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR.

AqNova's DPA implementation: the processor undertakes to assist AqNova in fulfilling its obligations to data subjects under GDPR Chapter III, including: rights of access; rectification; erasure; restriction of processing; data portability; and objection. The processor notifies AqNova of any data subject request received directly and does not respond independently unless specifically authorized by AqNova. See Section 7.7.7.

F. Assistance with Security, DPIA, and Prior Consultation (Article 28(3)(f))

28(3)(f) The processor shall assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36, taking into account the nature of processing and the information available to the processor.

AqNova's DPA implementation: the processor undertakes to provide AqNova with all information reasonably necessary to assess the processor's security of processing and to assist AqNova in: conducting DPIAs (GDPR Article 35); prior consultation with supervisory authorities where a high residual risk is identified (GDPR Article 36); personal data breach response (GDPR Articles 33–34). See Sections 7.7.6 and 7.7.8.

G. Data Deletion/Return at Termination (Article 28(3)(g))

28(3)(g) The processor shall, at the choice of the controller, delete or return all the personal data to the controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data.

AqNova's DPA implementation: see Section 7.7.9.

H. Audit and Inspection (Article 28(3)(h))

28(3)(h) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

AqNova's DPA implementation: see Section 7.7.8.

7.7.4 Sub-Processing Obligations

GDPR Article 28(2) requires that the processor not engage another processor without prior specific or general written authorization of the controller. AqNova's DPA provides for both specific and general authorization models:

A. General Authorization Model

For most processing relationships, AqNova's DPA provides general written authorization for the processor to engage sub-processors, subject to the following conditions:

The processor must notify AqNova of any intended changes to sub-processors (additions or replacements) by email to legal@aqnova.com at least 14 days before the change takes effect ('prior notice' mechanism).

AqNova reserves the right to object to any intended sub-processor change within the notice period. If AqNova objects, the processor must not engage the new sub-processor for AqNova's data.

Current sub-processors must be listed in Annex A to the DPA (Section 7.7.15). The processor updates Annex A to reflect any authorized sub-processor changes.

B. Sub-Processor Obligations

The processor must impose the same data protection obligations as set out in the DPA on any sub-processor it engages, by way of a written contract (GDPR Article 28(4)).

The processor remains fully liable to AqNova for the performance of the sub-processor's obligations under GDPR Article 28(4) — the engagement of a sub-processor does not relieve the processor of its responsibilities.

The processor must ensure that sub-processors implement appropriate technical and organizational security measures (GDPR Article 32) at least equivalent to those required of the processor under Annex B of the DPA.

7.7.5 Security of Processing — Technical & Organisational Measures

GDPR Article 32 requires that both the controller and processor implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. AqNova's minimum required security measures (specified in Annex B — Section 7.7.16) include:

A. Minimum Required Measures

Pseudonymisation and encryption: personal data must be pseudonymised and/or encrypted at rest and in transit where technically feasible and appropriate to the risk. Encryption minimum standard: AES-256 at rest; TLS 1.2+ in transit.

Confidentiality, integrity, availability, and resilience: ongoing ability to ensure confidentiality, integrity, availability, and resilience of processing systems and services.

Backup and recovery: ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident.

Testing and evaluation: process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures.

Access control: logical access controls restricting access to personal data to authorized personnel only; role-based access controls; principle of least privilege; multi-factor authentication for systems containing AqNova personal data.

Incident response: documented incident response plan covering detection, escalation, investigation, containment, and notification procedures.

Staff training: regular data protection training for all personnel with access to AqNova personal data.

Physical security: physical security measures for facilities where AqNova personal data is processed, appropriate to the risk.

B. Security Certifications

Where processors hold security certifications, these provide additional evidence of their security posture. AqNova gives preference to processors holding:

ISO/IEC 27001:2022 Information Security Management System certification.

SOC 2 Type II report covering the AqNova processing scope.

PCI DSS v4.0 Attestation of Compliance (for processors handling payment card data).

NIST Cybersecurity Framework alignment (particularly for US-based processors).

7.7.6 Personal Data Breach Notification

GDPR Article 33(2) requires processors to notify the controller without undue delay after becoming aware of a personal data breach. AqNova's DPA contains the following breach notification requirements:

7.7.7 Data Subject Rights Assistance

The processor must assist AqNova in fulfilling its data subject rights obligations under GDPR Chapter III (Articles 15–22). The following procedures apply:

Forwarding data subject requests: the processor must forward to AqNova any data subject request received directly (including requests for access, rectification, erasure, restriction, portability, or objection) within 5 Business Days of receipt. The processor must not respond independently to data subject requests unless specifically authorized by AqNova in writing.

Technical assistance: the processor must provide AqNova with technical assistance — including tools, access, or exports — necessary to enable AqNova to respond to data subject requests within applicable legal deadlines (EU/UK GDPR: 1 month; CCPA/CPRA: 45 days; LGPD: 15 days; etc.).

Deletion/erasure assistance: the processor must be technically capable of deleting specific data subjects' personal data upon AqNova's instruction, without affecting other data. The processor must confirm completion of deletion within 10 Business Days of receiving the instruction.

Data portability: the processor must be technically capable of providing personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) for data portability requests under GDPR Article 20.

7.7.8 Audit & Inspection Rights

GDPR Article 28(3)(h) requires the processor to allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. AqNova's DPA includes the following audit rights:

Information provision: the processor must promptly provide AqNova with all information necessary to demonstrate compliance with the DPA and GDPR Article 28, upon request.

Audit right (announced): AqNova has the right to conduct, or commission a third-party auditor to conduct, an audit of the processor's data processing activities and security measures relevant to AqNova's personal data, upon 30 Business Days' written notice.

Audit right (unannounced): in the event of a reasonable, documented concern about a data breach or significant non-compliance, AqNova reserves the right to conduct an unannounced audit.

Third-party audit reports as substitute: processors may satisfy audit requests by providing AqNova with current, in-scope third-party audit reports (ISO/IEC 27001 certificate + audit summary; SOC 2 Type II report; penetration test summary from accredited provider) in lieu of a direct audit, provided the reports are sufficiently current (not older than 12 months) and cover the scope of AqNova's processing.

Cost of audit: AqNova bears the cost of its own audits unless the audit reveals a material breach of the DPA, in which case the processor bears the reasonable costs of the audit.

Confidentiality: AqNova treats all audit information as confidential and uses it solely for the purpose of assessing the processor's compliance with the DPA.

7.7.9 Data Return, Deletion & Retention

GDPR Article 28(3)(g) requires the processor, at the controller's choice, to delete or return all personal data upon termination of the services, and to delete existing copies unless law requires storage. AqNova's DPA provisions:

Upon termination of services: within 30 calendar days of expiration or termination of the DPA (or the underlying service agreement), the processor must either: (a) return all AqNova personal data to AqNova in a structured, machine-readable format; OR (b) certifiably delete all AqNova personal data from its systems and those of its sub-processors, as AqNova directs.

Deletion certification: upon deletion, the processor must provide AqNova with a written certificate of deletion, specifying the data categories deleted, deletion methodology, and date of deletion.

Legal retention exceptions: where applicable law requires the processor to retain AqNova personal data beyond the service termination period, the processor must: inform AqNova of the legal retention obligation; retain only the minimum data required; protect it with at least the same security measures as during the service period; and delete it as soon as the legal retention period expires.

Backup copies: the processor must ensure that AqNova personal data in backup copies is deleted in accordance with the agreed timeline, which may differ from primary system deletion due to backup rotation schedules. The processor must confirm the expected timeline for backup deletion.

Retention during DPA: during the service period, the processor must retain personal data only as long as necessary for the purposes of providing the contracted services, or as instructed by AqNova.

7.7.10 International Data Transfers — SCCs & IDTA

Where the processor processes AqNova's personal data outside the European Economic Area (EEA) or the United Kingdom, the DPA incorporates international transfer mechanisms to ensure that the transfer is lawful under GDPR Chapter V and UK GDPR respectively.

A. EU Standard Contractual Clauses (SCCs)

AqNova's standard DPA incorporates the EU Standard Contractual Clauses adopted by Commission Implementing Decision 2021/914/EU of June 4, 2021, as Annex C to the DPA. The applicable module(s) are completed based on the processing relationship:

Module 1 (Controller-to-Controller): where the processor is an independent controller receiving AqNova personal data.

Module 2 (Controller-to-Processor): where the processor processes AqNova personal data on AqNova's behalf.

Module 3 (Processor-to-Processor): where AqNova as processor sub-processes to another processor.

Module 4 (Processor-to-Controller): where AqNova as processor sends data back to the controller.

Transfer Impact Assessment: consistent with EDPB Recommendations 01/2020 and the CJEU Schrems II judgment (C-311/18), where SCCs are the transfer mechanism, AqNova and its processors must conduct a Transfer Impact Assessment (TIA) to assess whether the law and practice of the receiving country provides an equivalent level of protection to EU data protection standards. Where the TIA identifies a gap, supplementary measures must be implemented.

B. UK International Data Transfer Agreement (IDTA)

For transfers of UK personal data, AqNova's DPA incorporates the UK Information Commissioner's International Data Transfer Agreement (IDTA — issued March 2022). The IDTA is the UK equivalent of EU SCCs and is required for transfers of UK personal data to countries not covered by a UK adequacy regulation.

The Addendum to the EU SCCs (issued by the ICO) may also be used where a single document is needed to cover both EU and UK data transfers consistently.

7.7.11 CCPA/CPRA Service Provider Obligations

Where AqNova is a business under the California Consumer Privacy Act (CCPA, Cal. Civ. Code § 1798.100 et seq.) and CPRA (Proposition 24, effective January 1, 2023), and a third party processes personal information on AqNova's behalf, the CCPA/CPRA requires that the parties enter into a written contract establishing a 'service provider' relationship. The absence of such a contract means the disclosure may constitute a 'sale' of personal information.

7.7.12 Global Jurisdiction-Specific DPA Provisions

AqNova's DPA includes jurisdiction-specific addendums for each major market. These addendums supplement the GDPR-based core DPA with requirements specific to each jurisdiction:

7.7.13 Liability & Indemnification

GDPR Article 82 establishes liability rules for controllers and processors. AqNova's DPA includes the following liability provisions consistent with Article 82 and applicable national law:

Controller liability: AqNova, as controller, is liable to data subjects for damage caused by processing that violates the GDPR, including processing by processors acting on AqNova's instructions.

Processor liability: the processor is liable to data subjects for damage caused by processing that violates the GDPR only where the processor has not complied with its GDPR obligations or has acted outside or contrary to AqNova's lawful instructions.

Right of recourse: where AqNova (as controller) has paid compensation to a data subject for damage caused by the processor's non-compliance, AqNova has the right of recourse against the processor for that part of the compensation corresponding to the processor's responsibility.

Indemnification: the processor indemnifies AqNova against claims, damages, fines, and costs (including regulatory fines under GDPR Article 83) arising from the processor's breach of the DPA or violation of applicable data protection law, to the extent the processor is responsible for such breach or violation.

Liability cap: the processor's aggregate liability to AqNova under the DPA is limited to the greater of: (a) the total fees paid by AqNova to the processor in the 12 months preceding the event giving rise to liability; or (b) USD 100,000 — unless the liability arises from gross negligence, fraud, or willful misconduct, in which case no cap applies.

7.7.14 DPA Term & Termination

Duration: the DPA is effective from the date of execution and remains in force for as long as the processor processes personal data on behalf of AqNova.

Automatic termination: the DPA terminates automatically upon expiration or termination of the underlying service agreement between AqNova and the processor.

Termination for material breach: AqNova may terminate the DPA immediately upon written notice if the processor materially breaches the DPA and fails to cure the breach within 10 Business Days of written notice specifying the breach.

Survival: Sections 7.7.6 (breach notification obligations for any ongoing breach), 7.7.9 (data return/deletion), 7.7.13 (liability and indemnification), and jurisdiction-specific provisions survive termination of the DPA.

7.7.15 Annex A — Details of Processing

Annex A to AqNova's DPA contains the mandatory details of processing required by GDPR Article 28(3). This Annex is completed specifically for each DPA counterparty and covers:

7.7.16 Annex B — Technical & Organisational Security Measures

Annex B specifies the minimum technical and organisational security measures that the processor must implement and maintain in connection with the processing of AqNova's personal data. These measures must meet the requirements of GDPR Article 32 and applicable national equivalent provisions:

7.7.17 Contact Information — Data Processing Agreement

AqNova Marketplace | Global Legal Footer Framework | Section 7.7: Data Processing Agreement (DPA)

© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.

THIS DOCUMENT IS FOR PLATFORM GOVERNANCE & REGULATORY COMPLIANCE PURPOSES ONLY. THE OPERATIVE DPA IS A SEPARATE BINDING LEGAL AGREEMENT. IT DOES NOT CONSTITUTE LEGAL ADVICE.