Data Processing Addendum

Last Updated on August 11, 2026

This Data Processing Addendum, including its Annexes ("DPA"), forms part of and is incorporated by reference into the Pykthos Terms of Service (the "Terms" or "Agreement") between KATLIV CORP. d/b/a Pykthos ("Pykthos," "we," "us," "our") and the customer that has accepted the Terms ("Customer," "you," "your"). This DPA applies where and to the extent Pykthos processes Personal Data on your behalf in connection with your use of the Pykthos platform and Services (the "Services"), and in particular where you or your end users are located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland, or where Applicable Data Protection Law otherwise requires a data processing agreement.

In the event of a conflict between this DPA and the Terms with respect to the processing of Personal Data, this DPA controls. Except as expressly modified here, the Terms remain in full force and effect. Capitalized terms not defined in this DPA have the meaning given in the Terms.

SECTION 1 – DEFINITIONS

"Applicable Data Protection Law" means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement, including, as applicable: the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"); the UK GDPR and the UK Data Protection Act 2018 (together, "UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation; and applicable U.S. state privacy laws, in each case as amended or replaced from time to time.

"Controller," "Processor," "Data Subject," "Personal Data," "Personal Data Breach," "Processing," and "Supervisory Authority" have the meanings given in the GDPR; where the UK GDPR, FADP, or a U.S. state privacy law applies, the equivalent terms under that law (for example, "business," "service provider," "consumer," and "personal information") apply correspondingly.

"Customer Personal Data" means Personal Data contained within Customer Data that Pykthos processes on the Customer's behalf as a Processor in the course of providing the Services (for example, the contacts, leads, and end-user records the Customer uploads to, or collects through, the platform).

"Sub-processor" means any third party engaged by Pykthos to process Customer Personal Data on Pykthos's behalf, including HighLevel (GoHighLevel) as the underlying platform provider.

"Standard Contractual Clauses" or "SCCs" means (a) for transfers subject to the GDPR, the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "EU SCCs"); and (b) for transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner ("UK Addendum"), in each case as amended or replaced from time to time.

SECTION 2 – ROLES AND SCOPE OF PROCESSING

2.1 Roles of the Parties. With respect to Customer Personal Data, the Customer is the Controller (or, where the Customer is itself acting as a processor for a third party, the processor), and Pykthos is the Processor (or sub-processor). Each party is responsible for complying with its own obligations under Applicable Data Protection Law.

2.2 Customer as Controller. As between the parties, the Customer determines the purposes and means of processing Customer Personal Data. The Customer is solely responsible for: (a) establishing and maintaining a valid legal basis for the collection and processing of Customer Personal Data; (b) providing all required notices to, and obtaining all required consents from, Data Subjects; (c) the accuracy, quality, and legality of Customer Personal Data and the means by which the Customer acquired it; and (d) ensuring that the Customer's instructions to Pykthos comply with Applicable Data Protection Law. This mirrors the Customer's responsibilities under the Terms.

2.3 Pykthos as Processor. Pykthos will process Customer Personal Data only as a Processor acting on behalf of the Customer, and will not sell Customer Personal Data or process it for its own independent purposes, for cross-context behavioral advertising, or for any purpose other than performing the Services and complying with the Customer's documented instructions and Applicable Data Protection Law.

2.4 Details of Processing. The subject matter, duration, nature, and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are described in Annex I.

SECTION 3 – PROCESSOR OBLIGATIONS

Pykthos agrees that it will, in respect of Customer Personal Data:

(a) Documented Instructions. Process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by law to which Pykthos is subject; in such a case, Pykthos will inform the Customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest. The Terms, this DPA, and the Customer's configuration and use of the Services constitute the Customer's complete and final documented instructions.

(b) Instructions That Infringe. Immediately inform the Customer if, in Pykthos's opinion, an instruction infringes Applicable Data Protection Law. Pykthos is not obligated to perform a legal review of the Customer's instructions but will notify the Customer where it becomes actually aware of such infringement.

(c) Confidentiality. Ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and are subject to appropriate access controls.

(d) Security. Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as further described in Annex II and in accordance with Article 32 of the GDPR.

(e) Sub-processing. Engage Sub-processors only in accordance with Section 4 below.

(f) Data Subject Rights Assistance. Taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise Data Subject rights (including access, rectification, erasure, restriction, portability, and objection). Where a Data Subject submits such a request directly to Pykthos, Pykthos will, to the extent legally permitted, promptly notify the Customer and will not respond directly except on the Customer's documented instruction or as required by law. The Services also provide self-service tools that allow the Customer to access, correct, export, and delete Customer Personal Data.

(g) Assistance with Compliance. Taking into account the nature of processing and the information available to Pykthos, assist the Customer in ensuring compliance with its obligations relating to security of processing (Article 32), Personal Data Breach notification (Articles 33 and 34), data protection impact assessments (Article 35), and prior consultation with a Supervisory Authority (Article 36).

(h) Personal Data Breach Notification. Notify the Customer without undue delay, and in any event where feasible within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide the Customer with information reasonably available to Pykthos to assist the Customer in meeting its own breach-notification obligations. Such notification is not an acknowledgement of fault or liability.

(i) Deletion or Return. At the Customer's choice, delete or return all Customer Personal Data to the Customer after the end of the provision of the Services, and delete existing copies unless retention is required by law. Following termination and any applicable wind-down or export period described in the Terms, Customer Personal Data remaining in the Services will be deleted in the ordinary course, subject to residual copies retained in secure backups for a limited period and then overwritten or deleted.

(j) Audits and Information. Make available to the Customer information reasonably necessary to demonstrate compliance with the obligations in Article 28 of the GDPR and this DPA, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to Section 6 below.

SECTION 4 – SUB-PROCESSORS

4.1 General Authorization. The Customer provides general written authorization for Pykthos to engage Sub-processors to process Customer Personal Data, subject to this Section. Pykthos's current Sub-processors are listed in Annex III. The Customer acknowledges and agrees that HighLevel (GoHighLevel) is an essential Sub-processor of the Services, as Pykthos provides its platform on a white-label basis using the HighLevel infrastructure.

4.2 Flow-Down of Obligations. Where Pykthos engages a Sub-processor, it will do so under a written contract that imposes data protection obligations substantially the same as, and no less protective than, those set out in this DPA, including appropriate security obligations. Pykthos remains liable to the Customer for the performance of each Sub-processor's data protection obligations to the same extent Pykthos would be liable if performing the services of that Sub-processor directly under this DPA.

4.3 Changes to Sub-processors. Pykthos will inform the Customer of any intended addition or replacement of a Sub-processor with a reasonable opportunity to object on reasonable data-protection grounds before the new Sub-processor begins processing Customer Personal Data. Notice may be given by updating Annex III or an online sub-processor list, by email, or by another reasonable means. If the Customer reasonably objects and the objection cannot be resolved, the Customer's sole and exclusive remedy is to terminate the affected Services in accordance with the Terms.

SECTION 5 – INTERNATIONAL DATA TRANSFERS

5.1 Transfers. The Customer acknowledges that Pykthos and its Sub-processors, including HighLevel, may process and store Customer Personal Data in the United States and in other countries outside the EEA, UK, and Switzerland.

5.2 Transfer Mechanism. To the extent Pykthos processes or transfers Customer Personal Data that is subject to the GDPR, UK GDPR, or FADP from the EEA, UK, or Switzerland to a country that has not been the subject of an adequacy decision, the Standard Contractual Clauses are hereby incorporated into and form part of this DPA by reference and will apply to such transfers, with Pykthos (and/or the relevant Sub-processor as data importer) and the Customer as data exporter completing the roles and Annexes accordingly. Where the EU SCCs apply, Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor) applies as appropriate to the parties' roles. For transfers subject to the UK GDPR, the UK Addendum applies to the EU SCCs. For transfers subject to the FADP, references in the EU SCCs are adjusted so that the FADP and the Swiss Federal Data Protection and Information Commissioner apply as appropriate.

5.3 Supplementary Basis. Where a valid adequacy mechanism such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) applies to Pykthos or a Sub-processor, the parties may rely on that mechanism; the Standard Contractual Clauses in Section 5.2 continue to apply as a fallback safeguard to the extent any such mechanism is invalidated, suspended, or does not cover a given transfer. HighLevel signs the Standard Contractual Clauses with its customers, including Pykthos, in respect of transfers of personal data to the United States.

5.4 Order of Precedence. In the event of any conflict between the Standard Contractual Clauses and this DPA or the Terms, the Standard Contractual Clauses prevail with respect to the transfers they govern.

SECTION 6 – AUDIT RIGHTS

Pykthos will, upon reasonable prior written request and no more than once per twelve (12) month period (unless required more frequently by a Supervisory Authority or following a Personal Data Breach affecting the Customer's Customer Personal Data), make available information reasonably necessary to demonstrate compliance with this DPA. Pykthos may satisfy this obligation by providing relevant certifications, third-party audit reports, or written responses to a reasonable security questionnaire. Any on-site inspection will be conducted during business hours, with reasonable advance notice, subject to Pykthos's confidentiality and security requirements, in a manner that does not disrupt Pykthos's operations, and at the Customer's expense. Audit rights with respect to a Sub-processor are exercised through Pykthos.

SECTION 7 – LIABILITY, TERM, AND GENERAL

7.1 Liability. Each party's and its affiliates' aggregate liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability set out in the Terms, and any reference in the Terms to the liability of a party means the aggregate liability of that party and its affiliates under the Terms and this DPA together. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law.

7.2 Term. This DPA takes effect on the date the Customer accepts the Terms (or, if later, the date this DPA is first incorporated into the Terms) and continues until Pykthos has ceased all processing of Customer Personal Data and deleted or returned it in accordance with Section 3(i). Provisions intended to survive termination will survive.

7.3 Governing Law. This DPA is governed by and construed in accordance with the governing-law and dispute-resolution provisions of the Terms (the laws of the Province of Ontario, Canada), except that, with respect to the transfers they govern, the Standard Contractual Clauses are governed by the law specified in those clauses.

7.4 Changes. Pykthos may update this DPA from time to time to reflect changes in Applicable Data Protection Law, Sub-processors, or the Services, provided that any such update will not materially reduce the protections for Customer Personal Data. The current version is posted at https://www.pykthos.com/dpa and is incorporated into the Terms by reference.

7.5 Contact. Data-protection questions and requests under this DPA, and requests for a countersigned copy of this DPA and its Standard Contractual Clauses, may be directed to [email protected].

ANNEX I – DETAILS OF PROCESSING

A. Parties.

Data Exporter / Controller: the Customer, as identified in its Pykthos account and its acceptance of the Terms.

Data Importer / Processor: KATLIV CORP. d/b/a Pykthos, 1869 Scugog Street, Suite 6-129, Port Perry, Ontario, Canada, L9L 1J1, [email protected].

B. Subject Matter. Pykthos's provision of the Services (a white-labeled customer-relationship, marketing, funnel, messaging, and business-automation platform) to the Customer under the Terms.

C. Duration. For the term of the Agreement, plus any applicable post-termination export and deletion period described in the Terms and this DPA.

D. Nature and Purpose of Processing. Hosting, storage, organization, retrieval, transmission, and other processing of Customer Personal Data as necessary to provide the Services and their features (including CRM/contacts, websites and funnels, forms and surveys, two-way email/SMS and other messaging, campaigns and workflows, calendars, invoicing, reputation management, social planning, and analytics), and to provide support, security, and billing.

E. Types of Personal Data. Personal Data that the Customer, its personnel, and its end users submit to or collect through the Services, which may include: names; email addresses; telephone numbers; postal addresses; business/employer and job details; IP addresses and device/usage data; communications content and message history; appointment and transaction records; and any other Personal Data the Customer chooses to process through the Services. The Customer is instructed not to upload special-category data or other sensitive data (including government identifiers, financial account numbers, and health information) except as expressly supported and lawfully permitted, consistent with the Terms.

F. Categories of Data Subjects. The Customer's contacts, leads, prospects, customers, end users, personnel, and other individuals whose Personal Data the Customer processes through the Services.

G. Frequency of Transfer. Continuous, for the duration of the Agreement.

ANNEX II – TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Pykthos, directly and through its Sub-processors, maintains technical and organizational measures designed to protect Customer Personal Data appropriate to the risk, which include, as applicable:

Encryption of Personal Data in transit over public networks (e.g., TLS) and encryption at rest for data stored in the underlying platform.

Logical access controls, role-based permissions, and authentication controls limiting access to Customer Personal Data to authorized personnel on a need-to-know basis.

Confidentiality obligations binding personnel with access to Customer Personal Data.

Network and application security safeguards, including monitoring, and regular testing for vulnerabilities in the platform.

Regular backups and data-recovery and data-integrity processes designed to restore availability and access to Personal Data in a timely manner following an incident.

Processes for detecting, assessing, and responding to Personal Data Breaches and for notifying affected customers.

Measures for ongoing review and, where necessary, improvement of the effectiveness of these measures.

Because Pykthos provides the Services on the HighLevel (GoHighLevel) infrastructure, the technical and organizational measures implemented by HighLevel as Sub-processor form part of the security measures applicable to Customer Personal Data. The parties acknowledge that specific measures may evolve; Pykthos will not materially decrease the overall level of security during the term.

ANNEX III – SUB-PROCESSORS

As of the date above, Pykthos engages the following Sub-processors to process Customer Personal Data:

Sub-processor Role / Service Provided Location of Processing HighLevel Inc. (GoHighLevel) Underlying white-label SaaS platform: hosting, storage, CRM, messaging, workflows, and related Services infrastructure United States Stripe, Inc. Payment processing for billing and transaction data, including Customer invoicing/checkout where applicable United States Twilio Inc. Telephony and SMS/text message delivery United States and, for messages sent to international destinations, applicable carrier regions Mailgun (Sinch Email / Pathwire) Outbound email delivery United States Cloud hosting and infrastructure providers used by the foregoing Data hosting and storage United States

This list may be updated in accordance with Section 4.3. For the current list, or to request notice of changes, contact [email protected].