Data Processing Addendum

Version 1.0. Effective October 12, 2026.

This Data Processing Addendum ("DPA") forms part of the Terms of Service (www.uirix.com/en/terms) between the Customer and EqualWeb Ltd., which operates UIRIX ("UIRIX", "we", "us"). It applies automatically whenever we process Customer Personal Data on the Customer's behalf. No signature is needed. If the Customer and UIRIX sign a different data processing agreement, the signed agreement applies instead.

On data-protection matters this DPA prevails over the Terms of Service. Words defined in the Terms of Service have the same meaning here.

• "Customer Personal Data": personal data of End Users that we process on the Customer's behalf to provide the Service, such as the data of people who call, chat with or are called by the Customer's agents, the Customer's contact lists and the people named in its agents' knowledge.
• "Data Protection Laws": the laws that apply to the processing of Customer Personal Data, which may include the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, Israel's Privacy Protection Law, 5741-1981 and its regulations, and US state privacy laws such as the California Consumer Privacy Act.
• "Controller", "processor", "personal data", "processing" and "data subject" have the meanings the Data Protection Laws give them; "business" and "service provider" have the meanings US state privacy laws give them.
• "Sub-processor": a third party we engage that processes Customer Personal Data.
• "Security Incident": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

2.1 Roles. For Customer Personal Data, the Customer is the controller (or the business) and UIRIX is its processor (or service provider). Where the Customer is itself a processor for someone else, UIRIX is its sub-processor, and the Customer is responsible for passing on to us any instructions and requirements of that controller.

2.2 Outside this DPA. This DPA does not cover the data for which UIRIX is the controller, such as account, billing, support and security data, our websites and our own marketing (Privacy Policy, Section 2.1), or a Personal AI Agent that an individual uses for personal purposes (Privacy Policy, Section 2.3).

2.3 The details of the processing are in Annex 1.

3.1 Documented instructions. We process Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA, the Customer's settings and the Customer's use of the Service (including through the API, Connected apps and Partners it authorizes) are those instructions. We may also process it where the law requires; in that case we tell the Customer first, unless the law forbids it.

3.2 Lawful instructions. We tell the Customer if, in our opinion, an instruction infringes the Data Protection Laws. The Customer is responsible for the lawfulness of its instructions and of the collection of Customer Personal Data, including the notices it gives and the consents it obtains (Terms of Service, Sections 5, 7 and 9.3).

Only staff who need access to provide, support and secure the Service can access Customer Personal Data, and they are bound by confidentiality. Sign-ins by our administrators to a Customer's account are recorded (Privacy Policy, Section 9.5).

5.1 Our measures. We implement and maintain the technical and organizational measures described in Annex 2, appropriate to the risk of the processing. We may update them, provided the overall level of protection does not decrease.

5.2 The Customer's part. The Customer is responsible for the security of its own credentials, API keys, configuration and systems, for the settings it chooses (for example the retention, recording, announcement and opt-out settings in Profile > Privacy), and for the services it connects (Terms of Service, Sections 3 and 16).

6.1 Authorization. The Customer authorizes the Sub-processors listed in Section 9.1 of our Privacy Policy (www.uirix.com/en/privacy#section-9). We impose on each Sub-processor, by written contract, data-protection obligations that protect Customer Personal Data at least as much as this DPA requires for the processing it performs, and we remain responsible for our Sub-processors as the Data Protection Laws provide.

6.2 Changes. We tell the Customer, by updating that list and by e-mail or in the dashboard, at least 30 days before a new Sub-processor starts handling Customer Personal Data. The Customer may object on reasonable data-protection grounds by writing to info@uirix.com within that period. We will try to address the objection; if we cannot, the Customer may cancel before the change applies, as Section 9.4 of the Terms of Service describes.

6.3 Services the Customer connects. Services the Customer connects or sends data to (Connected apps, integrations, webhook endpoints, e-mail recipients and Partners it authorizes) are not our Sub-processors. The Customer engages them and their own terms apply (Privacy Policy, Section 9.2).

UIRIX is established in Israel, which the European Commission, the United Kingdom and Switzerland recognize as providing adequate protection. Customer Personal Data may also be processed in the United States and in other countries where our Sub-processors operate (Privacy Policy, Section 10). Onward transfers from the EEA, the UK and Switzerland to our Sub-processors rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the Sub-processor is certified, or on the standard contractual clauses approved for these transfers. Transfers from Israel follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001. The Customer can ask for a copy of the relevant safeguards at info@uirix.com.

If we receive a request from a data subject about Customer Personal Data, we pass it to the Customer and do not answer it ourselves, unless the Customer asks us to or the law requires it (Privacy Policy, Section 14.4). The Service gives the Customer tools to answer requests: reading and exporting conversations through the Public API, the retention settings, and, on the Customer's instruction, deleting one person's conversations, recordings and contact details. Taking into account the nature of the processing, we give the Customer reasonable further assistance to answer requests it cannot answer with these tools.

We notify the Customer without undue delay after we become aware of a Security Incident affecting its Customer Personal Data. The notice describes, as far as we then know, what happened, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed, and we add information as it becomes available. We take reasonable steps to contain and investigate the incident and help the Customer meet its own notification duties. Notifying a Security Incident is not an admission of fault. Incidents caused by the Customer's own credentials, configuration or systems, or by services it connects, are not Security Incidents of ours, but we will tell the Customer what we see.

Taking into account the nature of the processing and the information available to us, we give the Customer reasonable assistance, mainly by providing information about the Service, for its data protection impact assessments and any prior consultation with a supervisory authority that the Data Protection Laws require.

11.1 During the Service. The Customer decides how long Customer Personal Data is kept, with the retention settings in Profile > Privacy and by deleting data in the Service (Privacy Policy, Section 12; Terms of Service, Section 15).

11.2 When the Service ends. At the Customer's request, we delete Customer Personal Data or make it available for export through the Public API or as a copy, and then delete it, unless the law requires us to keep it. Deleted data may remain in backups for up to 90 days until it is overwritten. Records that show compliance, such as do-not-call entries, opt-out and consent records, and usage and billing records, are kept as Section 3.4 of our Privacy Policy describes.

We make available the information necessary to demonstrate compliance with this DPA: this DPA, our Privacy Policy, the security measures in Annex 2 and our answers to a reasonable security questionnaire, once a year. Where the Data Protection Laws or a supervisory authority require more, the Customer, or an independent auditor bound by confidentiality, may audit our compliance once a year, on at least 30 days' written notice, during business hours, in a way that does not disrupt the Service or expose other customers' data, and at the Customer's cost.

Where US state privacy laws apply, we act as a service provider or processor and we:

• do not sell or share Customer Personal Data, including for cross-context behavioral advertising;
• do not retain, use or disclose it outside our direct business relationship with the Customer or for any purpose other than providing the Service, except as those laws allow (for example, to keep the Service secure and to create de-identified or aggregated data); we do not use it to improve the Service;
• do not combine it with personal data we receive from or on behalf of others, except as those laws allow;
• comply with the obligations those laws place on us and give it the same level of protection they require;
• tell the Customer if we can no longer meet these obligations.

The Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

Where Israeli law applies, the Customer owns the database of Customer Personal Data, and UIRIX holds it on the Customer's behalf and complies with the duties that the Privacy Protection Law and the Privacy Protection (Data Security) Regulations, 2017 place on a holder.

15.1 Liability. Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service (Sections 22 and 23), except where the Data Protection Laws do not allow it.

15.2 Term. This DPA applies for as long as we process Customer Personal Data on the Customer's behalf.

15.3 Changes. We may update this DPA. For a material change we tell the Customer at least 30 days before it applies, as Section 25 of the Terms of Service describes. Earlier versions are available on request at info@uirix.com.

15.4 Contact. Write to info@uirix.com about this DPA, a Security Incident or a data-protection question.

• Subject matter: providing the Service, AI voice and chat agents that answer and place calls, chat on websites, send messages and keep records, for the Customer.
• Duration: for as long as we provide the Service to the Customer, and then until deletion under Section 11.
• Nature and purpose: receiving, recording, transcribing, translating, summarizing and analyzing calls and chats; running the Customer's agents and their actions (such as leads, tickets, appointments, orders, transfers, messages and outbound calls and campaigns); storing and returning the records; checking do-not-call and block lists and keeping opt-out and consent records; and the other processing the Customer configures.
• Data subjects: people who call, chat with, are called or messaged by, or are transferred by the Customer's agents; people on the Customer's contact and do-not-call lists; people named in the Customer's knowledge and instructions; the Customer's staff whose details its agents use.
• Categories of data: names, phone numbers, e-mail addresses and other contact details; call audio and recordings; transcripts, summaries and the details extracted from them; the caller name and location the phone carrier provides; on websites, the IP address, browser and page details described in Section 3.4 of our Privacy Policy; data the Customer's systems pass to its agents; contact lists, call history, do-not-call entries and consent records; documents and knowledge the Customer uploads.
• Special categories: the Service is not designed for them, and the Customer must not submit them unless we agree in writing (Privacy Policy, Section 13).

• TLS encryption for connections between browsers or applications and our websites, dashboard and API.
• Salted password hashes.
• Public API keys and the tokens of connected AI applications stored only as hashes, limited by permissions, expiring and revocable; a key's secret is shown once, when it is created.
• Encrypted webhook signing secrets and signed webhook deliveries.
• Optional two-step verification by text message, and limits on failed sign-in attempts.
• Access to accounts limited to authorized staff, with recorded administrator sign-ins.
• Security logging and monitoring of the Service (Privacy Policy, Section 6).
• Backups, kept for up to 90 days.
• Masking of payment card numbers in the stored text of website and dashboard chats and website voice conversations (Privacy Policy, Section 13.2).
• Customer controls: retention periods, call recording on or off, masking of personal data in Public API responses, and the compliance settings in Profile > Privacy.

The current list of Sub-processors, with what each one does and where, is in Section 9.1 of our Privacy Policy: www.uirix.com/en/privacy#section-9.